or more changes to, the proposed requirements. After considering these
comments, we have revised the proposed requirements as shown in table
30, with editorial and conforming changes as shown in table 52.

  Table 30--Revisions to the Proposed Requirements for Hazard Analysis
------------------------------------------------------------------------
            Section                Description            Revision
------------------------------------------------------------------------
117.130(a)(1).................  Requirement for a  Specify that a
                                 hazard analysis.   facility must
                                                    ``conduct a hazard
                                                    analysis'' to
                                                    identify and
                                                    evaluate known or
                                                    reasonably
                                                    foreseeable hazards,
                                                    rather than merely
                                                    specify that a
                                                    facility must
                                                    ``identify and
                                                    evaluate'' known or
                                                    reasonably
                                                    foreseeable hazards.
117.130(a)(2).................  Requirement for    Clarify that the
                                 the hazard         hazard analysis must
                                 analysis to be     be written,
                                 written.           regardless of its
                                                    outcome.
117.130(b)(1) and (b)(2)......  Hazard             Emphasize that the
                                 identification.    hazard
                                                    identification
                                                    focuses on known or
                                                    reasonably
                                                    foreseeable hazards
                                                    (rather than on all
                                                    hazards).
117.130(b)(1)(iii)............  Hazard             Add examples of
                                 identification.    physical hazards.
117.130(c)(1)(ii).............  Hazard evaluation  Provide that hazard
                                                    evaluation does not
                                                    need to include an
                                                    evaluation of
                                                    environmental
                                                    pathogens whenever
                                                    RTE food is exposed
                                                    to the environment
                                                    prior to packaging
                                                    if the packaged food
                                                    includes a control
                                                    measure (such as a
                                                    formulation lethal
                                                    to the pathogen)
                                                    that would
                                                    significantly
                                                    minimize the
                                                    pathogen.
117.130(c)(2)(x)..............  Hazard evaluation  Provide an example of
                                                    ``other relevant
                                                    factor'' that the
                                                    hazard evaluation
                                                    must consider (the
                                                    example is the
                                                    temporal (e.g.,
                                                    weather-related)
                                                    nature of some of
                                                    some hazards (e.g.,
                                                    levels of some
                                                    natural toxins)).
------------------------------------------------------------------------

A. Proposed Sec.  117.130(a)--Requirement for a Written Hazard Analysis

    We proposed that you must identify and evaluate, based on
experience, illness data, scientific reports, and other information,
known or reasonably foreseeable hazards for each type of food
manufactured, processed, packed, or held at your facility to determine
whether there are significant hazards. We also proposed that the hazard
analysis must be written. As discussed in Response 126, we have revised
the term ``significant hazard'' to ``hazard requiring a preventive
control.''

    (Comment 385) Some comments ask us to specify that the rule
requires a written hazard analysis even if the hazard analysis
concludes that no hazards exist.
    (Response 385) As proposed, the regulatory text would require a
written hazard analysis even if the hazard analysis concludes that no
hazards exist. To make this clearer, we have made two revisions to the
regulatory text. First, we have revised the regulatory text to specify
that a facility must ``conduct a hazard analysis'' to identify and
evaluate known or reasonably foreseeable hazards, rather than merely
specify that a facility must ``identify and evaluate'' known or
reasonably foreseeable hazards. Second, we have revised the regulatory
text to specify that the hazard analysis must be written regardless of
its outcome.
    (Comment 386) Some comments assert that a facility should not be
able to conclude that no hazard exists in its production process and
that any such conclusion reached should be a ``red flag'' to FDA
investigators.
    (Response 386) The purpose of a hazard analysis is to identify and
evaluate known or reasonably foreseeable hazards to determine whether
there are any hazards requiring a preventive control. If a facility
appropriately determines, under the oversight of a preventive controls
qualified individual, that no such hazards exist, then that is the
outcome of its hazard analysis, and the facility must document that
outcome in its written hazard analysis. (See also Response 222,
Response 226, Response 229, Response 232, Response 397, Response 721,
and Response 726.)
    However, we agree that our investigators should take appropriate
steps to evaluate a facility's hazard analysis when the outcome is that
there are no hazards requiring a preventive control. We expect that our
investigators would both review the facility's written hazard analysis
and discuss the outcome with the facility. During the initial stages of
implementation, we also expect that our investigators will ask subject
matter experts in our Center for Food Safety and Applied Nutrition
(CFSAN) to review such a hazard analysis. Over time, as our
investigators gain experience with appropriate determinations that
there are no hazards requiring a preventive control, we expect that
there will be fewer circumstances in which our investigators would
consult CFSAN about such an outcome.
    (Comment 387) Some comments ask us to require facilities to provide
supporting documentation in the hazard analysis and assert that such a
requirement would be consistent with the requirements of the FSIS HACCP
regulation for meat and poultry.
    (Response 387) We made no changes to the regulatory text to
specifically require that a facility ``provide supporting
documentation'' in its hazard analysis. A facility has flexibility to
determine the appropriate content of its written hazard analysis,
provided that the written hazard analysis complies with the
requirements for hazard identification and hazard evaluation (see Sec.
117.130(b) and (c)). A facility must be able to justify its hazard
analysis decisions, even if the supporting documentation is not
specifically included with the hazard analysis. For example, a facility
that relies on one or more scientific publications to support its
hazard analysis might include a bibliography listing the relevant
publications, but not include a copy of the listed publications.
Differences in the regulatory text of this rule compared to the FSIS
HACCP regulation for meat and poultry reflect the flexible framework
provided by FSMA but do not create a conflict.
    (Comment 388) Some comments ask us to modify the provision to
specify that the hazard analysis identify and evaluate known or
reasonably foreseeable hazards for each type of food manufactured,
processed, packed, or held at the facility, including hazards in the
raw materials and ingredients used in the food (emphasis added).
    (Response 388) We decline this request. Other provisions in the
requirements for hazard analysis specify that the hazard evaluation
must consider raw materials and ingredients (see Sec.
117.130(c)(2)(iii)). It is not necessary to repeat the specific
requirements associated with the hazard evaluation in the provision
that directs each facility to conduct a hazard analysis.
    (Comment 389) Some comments ask us to modify the provision to use
``or'' instead of ``and'' in the clause ``based on experience, illness
data, scientific reports, and other information'' because it is not
necessary to evaluate all of the specified criteria in all cases.
    (Response 389) We decline this request. We agree that in some cases
some of the specified types of information may not be available. For
example, if a food product has not been associated with foodborne
illness, there would be no illness data. However, modifying the
provision as suggested by the comments would establish a regulatory
requirement in which a facility could pick and choose which information
to evaluate, irrespective of whether the information is available.
    (Comment 390) Some comments point out that the Codex HACCP Annex
includes ``mileposts'' for the identification of hazards, recommending
that the HACCP Annex apply to ``all of the hazards that may be
reasonably expected to occur at each step from primary production,
processing, manufacture, and distribution until the point of
consumption.'' These comments ask us to include such ``mileposts'' in
the requirements to conduct a hazard analysis to put the regulations in
better alignment with the Codex HACCP Annex and underscore the fact
that food producers cannot anticipate or be responsible for customer
behavior that is contrary to general principles of food safety.
    (Response 390) By ``mileposts'' for hazard identification, we
assume that the comments are referring to the steps included in the
Codex HACCP Annex regarding the recommendation to list all potential
hazards associated with each step, conduct a hazard analysis, and
consider any measures to control identified hazards. These steps
include consideration of: (1) The likely occurrence of hazards and
severity of their adverse health effects; (2) the qualitative and/or
quantitative evaluation of the presence of hazards; (3) survival or
multiplication of microorganisms of concern; (4) production or
persistence in foods of toxins, chemicals or physical agents; and (5)
conditions leading to these factors (Ref. 34).
    We agree that a hazard analysis should address known or reasonably
foreseeable hazards at each step from primary production, processing,
manufacture, and distribution until the point of consumption. For
example, a facility that produces cut or shredded RTE carrots might
consider pathogens such as Salmonella that can occur at primary
production; metal from the slicers or shredders, and L. monocytogenes
as an environmental pathogen, during manufacturing/processing; and
refrigeration until the end of the shelf life to prevent the growth of
pathogenic sporeforming bacteria.
    However, to the extent that these comments are asserting that a
facility can ignore consumer behavior that the facility considers
contrary to principles of food safety, we disagree. For example, a
facility could not conclude that it need not identify and evaluate
known or reasonably foreseeable hazards because the facility intends to
provide cooking instructions on the label of a packaged food. Consumer
research indicates that

consumer cooking practices are not uniform and that many consumers do
not follow some cooking instructions, such as those on frozen foods or
directions specifying that a product should be cooked until it reaches
a certain temperature (Ref. 66) (Ref. 67).
    (Comment 391) Some comments ask us to require that the hazard
analysis be re-evaluated every three years and updated as needed.
    (Response 391) The written hazard analysis is one component of the
food safety plan, and the food safety plan is subject to reanalysis at
least every three years (see Sec.  117.170).
    (Comment 392) Some comments state that the standard for hazard
analysis in the human preventive controls rule should both align with
the re-proposed requirements for hazard analysis set forth in the
supplemental FSVP notice and be consistent with the statutory standard
for hazard analysis in section 418(b)(1) of the FD&C Act.
    (Response 392) We have aligned the requirements of the human
preventive controls rule and the proposed FSVP rule to the extent
practicable, consistent with the applicable statutory requirements.
    (Comment 393) Some comments ask us to endorse a template, format,
or style to be used for a hazard analysis to ensure these analyses are
conducted consistently across the food industry and that auditors are
consistent in their evaluation.
    (Response 393) We decline this request. See Response 373.

B. Proposed Sec.  117.130(b)--Hazard Identification

    We proposed that the hazard identification must consider hazards
that include biological, chemical, and physical hazards. We proposed to
list examples of biological hazards (i.e., microbiological hazards such
as parasites, environmental pathogens, and other pathogens) and
chemical hazards (i.e., radiological hazards and substances such as
pesticide and drug residues, natural toxins, decomposition, unapproved
food or color additives, and food allergens). In the preamble (78 FR
3646 at 3734)], we provided examples of physical hazards (i.e., stones,
glass, or metal fragments that could inadvertently be introduced into
food) but did not propose to include these examples in the regulatory
text.
    We also proposed that the hazard identification must consider
hazards that may be present in the food if they occur naturally, may be
unintentionally introduced, or may be intentionally introduced for
purposes of economic gain.
    (Comment 394) As discussed in Comment 126, some comments express
concern that the rule would refer to multiple levels of hazards (i.e.,
``hazards,'' ``known or reasonably foreseeable hazards,'' and
``significant hazards'' (which we now refer to as ``hazards requiring a
preventive control'') and ask us to provide sufficient clarity to be
able to distinguish between these types of hazards.
    (Response 394) As discussed in Response 126, we have revised the
requirements for hazard identification to emphasize that the hazard
identification focuses on known or reasonably foreseeable hazards
(rather than on all hazards).
    (Comment 395) Some comments ask us to include examples of physical
hazards in the regulatory text.
    (Response 395) We have added stones, glass, and metal fragments as
examples of physical hazards in the regulatory text. This is consistent
with the regulatory text for biological and chemical hazards, even
though the hazards listed in section 418(b)(1) of the FD&C Act include
examples of chemical and biological hazards but do not include examples
of physical hazards.
    (Comment 396) Some comments ask us to separately list some hazards
(such as parasites and drug residues) rather than include them as
examples of biological hazards and chemical hazards.
    (Response 396) We decline this request. Although section
418(b)(1)(A) of the FD&C Act lists such items separately, we believe it
is clearer to acknowledge that some of the hazards listed in the
statute are in fact a subset of the broader categories of biological
and chemical hazards.
    (Comment 397) Some comments ask us to rephrase the requirement for
hazard identification to specify ``The hazard analysis must identify
hazards'' rather than ``The hazard identification must consider
hazards.''
    (Response 397) We decline this request. The provision is directed
to the first step of a hazard analysis--i.e., hazard identification--
rather than to the overall hazard analysis (which is addressed in Sec.
117.130(a)). The purpose of the hazard identification is to consider
the types of hazards listed in the provision as a step in determining
whether there are any hazards requiring a preventive control; the
suggestion of the comments implies that such hazards will always be
identified. As discussed in Response 386, the outcome of a hazard
analysis for a food product could be that there are no hazards
requiring a preventive control.
    (Comment 398) Some comments ask us to broaden the examples listed
for chemical hazards to include ``allergens and ingredients associated
with food sensitivities.''
    (Response 398) We decline this request. Although the presence of an
undeclared ingredient associated with a food sensitivity (such as the
color additive Yellow #5) can be considered a chemical hazard for the
sensitive population, it is neither practical nor necessary for the
list of examples of chemical hazards in the regulatory text to be
exhaustive.
    (Comment 399) Some comments assert that we should not require all
food safety plans to specifically address the likelihood of
radiological hazards.
    (Response 399) The rule only requires that a facility consider
whether radiological hazards are known or reasonably foreseeable, and
we have described situations where radiological hazards could be
considered to be known or reasonably foreseeable (78 FR 3646 at 3667).
A facility that appropriately determines that no radiological hazards
are known or reasonably foreseeable would document that determination
in its written hazard analysis but would not need to establish
preventive controls and associated preventive control management
components to address radiological hazards.
    (Comment 400) Some comments addressing radiological hazards ask us
to clarify that radiological hazards are an example of chemical
hazards; clarify the requirements by identifying specific radiological
hazards and including them in the regulatory text; develop a baseline
for acceptable levels and specific monitoring recommendations for each
product; defer compliance on the control of radiological hazards until
more comprehensive information is available to industry and regulators
on how best to control for and assess compliance in controlling the
hazard; clarify whether irradiation of produce for phytosanitary
purposes must be considered as a potential radiological hazard; confirm
that a facility is required to assess only two types of radiological
hazards (production water and accidental contamination from accidental
release from a nuclear facility); and clarify whether we will require
consideration of radiological hazards by processors subject to our
HACCP regulations for seafood and juice.
    (Response 400) The regulatory text specifies that radiological
hazards are an example of chemical hazards. We decline the requests to
identify specific radiological hazards, include them in

the regulatory text, and develop a baseline for acceptable levels, with
specific monitoring recommendations for each product type. As discussed
in the 2013 proposed human preventive controls rule (78 FR 3646 at
3667), radiological contamination of foods is a rare event. The most
relevant information that would lead a food facility to consider and
evaluate a specific radiological hazard to determine whether it is a
hazard requiring a preventive control would be publicly disseminated
information following a particular event, such as contamination arising
from accidental release from a nuclear facility or from damage to a
nuclear facility from a natural disaster. We already have issued
guidance on levels of concern for radionuclides that could be a known
or reasonably foreseeably hazard in certain circumstances, such as
after an accident at a nuclear facility (Ref. 68). In light of this
current guidance, we see no reason to provide additional guidance to
address hypothetical circumstances or to defer compliance until more
information is available.
    A facility does not need to consider sources of radiation used in
accordance with a food additive regulation in its hazard analysis. Such
sources are safe for their intended use. As with any other equipment
and substances used in the manufacture of food, a facility must comply
with all applicable safety requirements established either under the
terms of a food additive regulation or by an authority such as the
Occupational Safety and Health Administration. Although production
water and accidental contamination from accidental release from a
nuclear facility would be the two most likely sources of radiological
hazards that a facility would need to address, we are not limiting the
facility's responsibilities to these two sources. We cannot anticipate
the future.
    We have not taken action to revise either our HACCP regulations for
seafood and juice or our current guidance on hazards and controls for
seafood and juice (Ref. 42) (Ref. 43) to require or recommend that
processors of those products address radiological hazards in their food
safety plans. However, in the event of a situation such as an accident
at a nearby nuclear facility, it would be prudent for such processors
to consider whether the potential for contamination with radiological
hazards would warrant modification of their food safety plans.
    (Comment 401) Some comments assert that predictable intentional
hazards should be in the food safety plan but unexpected intentional
hazards should be part of a food defense plan.
    (Response 401) This rule only requires a facility to consider
intentionally introduced hazards when such hazards are introduced for
purposes of economic gain. Hazards that may be intentionally introduced
by acts of terrorism are the subject of the 2013 proposed intentional
adulteration rule (78 FR 78014, December 24, 2013).
    (Comment 402) Some comments disagree that the human preventive
controls rule should address hazards that are intentionally introduced
for purposes of economic gain (economically motivated adulteration).
Some of these comments assert that economically motivated adulteration
is not a good fit for the hazard analysis and preventive controls
framework because it is, in all but the rarest of circumstances, an
issue of product integrity and quality, whereas food safety systems are
designed and built to prevent or mitigate food safety hazards. Some
comments state that traditional food safety hazards are primarily both
identified and addressed at the facility level, but economically
motivated adulteration is typically handled by the corporate parent
company, where supply chain management programs are typically located.
These comments also assert that food safety-related economically
motivated adulteration is extremely rare and that predicting
economically motivated adulteration to prevent it is extremely
difficult. Some comments assert there will be no measurable benefit to
food safety by imposing requirements to consider economically motivated
adulteration as part of a food safety plan and that doing so will
consume limited resources without a corresponding increase in consumer
protection. Other comments assert that there is no need to require a
facility to identify hazards intentionally introduced for purposes of
economic gain because the misbranding and adulteration provisions of
the FD&C Act already sufficiently provide safeguards against economic
gain.
    (Response 402) We agree with the comments stating that the
requirement to consider hazards intentionally introduced for purposes
of economic gain is narrow. Such hazards will be identified in rare
circumstances, usually in cases where there has been a pattern of
economically motivated adulteration in the past. In addition, we define
hazards to only include those agents that have the potential to cause
illness or injury. Economically motivated adulteration that affects
product integrity or quality, for example, but not food safety, is out
of the scope of this rule. We continue to believe that there is benefit
in taking this preventive approach to economically motivated
adulteration, and not solely on enforcing the preexisting misbranding
and adulteration provisions of the FD&C Act after a violation occurs.
    As discussed in sections XLII through XLIX, we are finalizing
supply-chain program provisions. It is consistent with the framework of
this rule for a facility to address hazards requiring a preventive
control that may be intentionally introduced for purposes of economic
gain through the facility's supply-chain program.
    (Comment 403) Some comments express concern about identifying
hazards that may be intentionally introduced for purposes of economic
gain because there are potentially an unlimited number of unknown or
yet-to-be-identified hazards that could be intentionally introduced for
purposes of economic gain by an unscrupulous supplier. These comments
disagree with our attempt to narrow the field of potential scenarios
for economically motivated adulteration to circumstances where there
has been a pattern of such adulteration in the past.
    Some comments assert that our attempt to narrow the field of
potential scenarios for economically motivated adulteration is both too
broad and too narrow at the same time. These comments assert that our
attempt is too broad, because we expect facilities to consider patterns
of adulteration from the past ``even though the past occurrences may
not be associated with the specific supplier or the specific food
product'' and a requirement to consider every potential product and
potential supplier makes the task open ended. These comments further
assert that our attempt is too narrow, because a focus on patterns of
adulteration in the past is unlikely to reveal potential future
instances of economically motivated adulteration and because those
intending to defraud purchasers for economic gain are trying to avoid
detection. According to these comments, once a food safety-related
instance of economically motivated adulteration is uncovered,
perpetrators quickly move to carry out their fraudulent activities in a
different way. Some comments assert that there are alternative ways to
control hazards that may be intentionally introduced for purposes of
economic gain without specific regulatory requirements, such as by
having an effective supplier approval program with appropriate
qualification and verification activities; through business-to-business
relations, expectations, and contracts; and through

a vulnerability assessment and control plan tailored specifically to
economically motivated adulteration.
    (Response 403) We disagree that the requirement is too broad. A
facility must conduct a hazard analysis for each type of food
manufactured, processed, packed, or held at the facility. There is no
requirement to consider every potential product or potential supplier.
We also disagree that the requirement is too narrow. Some individuals
intending to defraud purchasers for economic gain will develop entirely
novel ways of adulterating food to suit their purposes. We agree that
these circumstances may not lend themselves to the preventive approach
required here. We encourage, but do not mandate, that facilities adopt
other measures they deem appropriate to mitigate the risks of
economically motivated adulteration that this rulemaking does not
address. Still, the repeated economically motivated adulteration of
spices with toxic colorants demonstrates that patterns of economically
motivated adulteration can emerge and should be considered as part of a
food safety plan (see the examples in the 2014 supplemental human
preventive controls notice, 79 FR 58524 at 58550-58551).
    (Comment 404) Some comments ask us to limit the requirement to
identify hazards that may be introduced for purposes of economic gain
to only those hazards that pose a risk to public health for which there
has been a pattern in the past. Some comments assert that in those few
instances where a hazard was intentionally introduced the underlying
intention was to defraud rather than to cause harm, and the food safety
hazard was an unintended consequence. Some comments ask us to focus the
hazard identification solely on inbound products, because it is obvious
that hazards introduced by the facility itself will not be prevented
through a hazard analysis. Some comments ask us to narrow the scope of
the requirement by specifying that facilities focus on three
situations: (1) Situations in which there has been a pattern of similar
adulteration in the past; (2) foods or ingredients for which quality
assurance methods may not sufficiently characterize the food or
ingredient to assure its identity, and; (3) foods or ingredients for
which there are substitutes that are likely to be harmful that would be
considered obvious to one skilled in food science.
    (Response 404) We decline to make the changes suggested in these
comments, because they are unnecessary. Because of our definition of
hazard, the requirement is already limited to economically motivated
adulteration that has the potential to cause illness or injury. Under
the final rule, a facility does not need to identify a hazard related
to economically motivated adulteration when there is no risk to public
health or when the economically motivated adulteration is not known or
reasonably foreseeable.
    We agree that the three circumstances suggested by the comments are
an appropriate focus for facilities who seek guidance on how to
approach the requirements, but decline the request to specify these
limitations of the scope in the regulatory text. As already noted, some
comments assert that our attempt to narrow the field of potential
scenarios for economically motivated adulteration is both too broad and
too narrow at the same time (see Comment 403). Although we continue to
believe that the instances in which a facility will identify a hazard
intentionally introduced for economic gain will be rare, we also
consider that limiting the scope of the requirement in the regulatory
text would be both pre-judging the future and inconsistent with the
public health objectives of this rule.
    (Comment 405) Some comments ask us to allow implementation of the
major provisions in FSMA before establishing requirements to address
economically motivated adulteration. These comments assert that
economically motivated adulteration requires a completely different
paradigm than unintentional adulteration. In addition, because
economically motivated adulteration is typically addressed through
product specifications, supplier relationships, and good business
practices, implementation of these other provisions of the human
preventive controls rule are likely to have a positive effect on
preventing economically motivated adulteration.
    (Response 405) We disagree that economically motivated adulteration
requires a completely different paradigm than unintentional
adulteration. Hazards intentionally introduced for economic gain are
addressed here with the same preventive framework as every other
hazard. As such, we do not see a compelling reason to delay
implementation of the requirements to address economically motivated
adulteration.

C. Proposed Sec.  117.130(c)--Evaluation of Whether a Hazard Requires a
Preventive Control

    We proposed that the hazard analysis must include an evaluation of
the identified hazards to assess the severity of the illness or injury
if the hazard were to occur and the probability that the hazard will
occur in the absence of preventive controls; and environmental
pathogens whenever an RTE food is exposed to the environment prior to
packaging and the packaged food does not receive a treatment that would
significantly minimize the pathogen (proposed Sec.  117.130(c)(1)). We
also proposed that the hazard evaluation must consider the effect of
the following on the safety of the finished food for the intended
consumer: (1) The formulation of the food; (2) the condition, function,
and design of the facility and equipment; (3) raw materials and
ingredients; (4) transportation practices; (5) manufacturing/processing
procedures; (6) packaging activities and labeling activities; (7)
storage and distribution; (8) intended or reasonably foreseeable use;
(9) sanitation, including employee hygiene; and (10) any other relevant
factors (proposed Sec.  117.130(c)(2)).
    (Comment 406) Some comments ask us to revise the requirement to
include an evaluation of environmental pathogens to avoid the
implication that an intervention is needed when there may be other
controls (such as pH or formulation) that would significantly minimize
or prevent the pathogen. These comments suggest that we revise the
provision to require that a hazard evaluation include an evaluation of
environmental pathogens whenever an RTE food is exposed to the
environment prior to packaging and the packaged food does not receive a
treatment ``or otherwise include a control measure'' that would
significantly minimize the pathogen.
    (Response 406) We have revised the provision on the hazard
evaluation for environmental pathogens to specify that the packaged
food does not receive a treatment or otherwise include a control
measure (such as a formulation lethal to the pathogen) that would
significantly minimize the pathogen. We agree that controls such as
formulation can function as a ``kill step'' and that the provision
should make clear that such controls can be used in lieu of
``treatment.''
    (Comment 407) Some comments ask us to clarify what we meant by
``other relevant factors'' and note that natural disasters (which we
previously discussed) (78 FR 3646 at 3738) are ``usually exceptional
events'' that are best managed in a facility crisis management plan.
Other comments ask us to specify that the hazard evaluation must
consider any relevant geographic, temporal, agricultural, or other
factors that may affect the severity or probability of the hazard.

    (Response 407) We included ``other relevant factors'' to emphasize
that the list of factors in the provision is not an exhaustive list and
that a facility is responsible to consider those factors that play a
role in its determination of whether a potential hazard is a hazard
requiring a preventive control, regardless of whether those factors are
listed in the provision. A facility that already addresses
circumstances such as natural disasters in other plans may consider the
applicable part of those plans to be part of its food safety plan (see
Sec.  117.330).
    We agree that geographic, temporal, and agricultural factors are
examples of ``other relevant factors.'' For example, hazards such as
aflatoxin are subject to a weather-dependent effect in that aflatoxin
levels in some RACs are more of a problem in some years than in others.
We have added the temporal nature of some hazards associated with some
RACs as an example of ``other relevant factors'' to consider (see Sec.
117.130(c)(2)(x)).
    (Comment 408) Some comments assert that it is unnecessary to
establish a specific provision that identifies environmental pathogens
as a hazard that is required to be evaluated.
    (Response 408) We are retaining the provision, which we proposed to
highlight the importance of environmental pathogens in some facilities
and to make clear that sanitation controls, with appropriate
verification, may be necessary in addition to sanitation measures that
the facility establishes as a matter of CGMP.
    (Comment 409) Some comments assert that it can be difficult to
determine ``the severity of the illness or injury if the hazard were to
occur'' for a food that is not RTE food, especially for raw materials
and ingredients.
    (Response 409) We acknowledge that determining the severity of the
illness or injury if the hazard were to occur can be more difficult for
some foods than for other foods. However, recent outbreaks and large-
scale recalls demonstrate the potential for some raw materials and
other ingredients to cause serious illness or injury (78 FR 3646 at
3656 and 3737). For reasons such as these, the rule requires that a
facility identify and evaluate multiple sources of information (i.e.,
experience, illness data, scientific reports, and other information)
and also requires that the food safety plan (which includes the written
hazard analysis) be prepared, or its preparation overseen, by one or
more preventive controls qualified individuals (see Sec.
117.126(a)(2)).
    (Comment 410) Some comments ask us to provide that a facility may
rely on existing systems in place to manage radiological risks, such as
steps taken by government officials to inspect ingredients obtained
from a geographic region that has been the subject of a nuclear
accident.
    (Response 410) A facility may consider all available resources in
appropriately determining whether a known or reasonably foreseeable
radiological hazard is a hazard requiring a preventive control and in
appropriately determining what preventive controls, and associated
preventive control management components, to establish and implement in
light of a radiological hazard that is a hazard requiring a preventive
control. However, existing systems in place to manage radiological
risks, such as after a nuclear accident, do not absolve a facility of
its responsibilities to establish and implement preventive controls to
address a radiological hazard when circumstances warrant.
    (Comment 411) Some comments assert that there would be no need to
evaluate an environmental pathogen if the finished food is inherently
incapable of supporting pathogen survival (e.g., in acid or acidified
foods). These comments ask us to modify the requirement to narrow the
circumstances when it would apply to whenever an RTE food is ``capable
of supporting pathogen growth to, or survival at, infectious levels.''
    (Response 411) The suggestion of the comments pre-judges the
outcome of the hazard analysis for a wide variety of food products. A
facility can consider factors such as whether the formulation of a food
would not support the growth of the pathogen to increased numbers, or
would cause pathogens to die off over time, in determining whether an
environmental pathogen is a hazard requiring a preventive control.
Importantly, for many pathogens the mere presence of the pathogen
presents a risk of illness, and the time necessary for pathogens in the
food to die off due to the formulation of the food varies. Thus, a
facility that appropriately determines that an environmental pathogen
is not a hazard requiring a preventive control due to factors such as
formulation of a food would need to document the basis for its
determination in its written hazard analysis.
    (Comment 412) Some comments ask us to include a definition for
``exposed to the environment'' to avoid confusion. These comments state
their understanding that this phrase means that the product is in a
form that is exposed and/or subject to direct human contact.
    (Response 412) We decline this request. It is not necessary to
define every term and phrase included in the rule. See the Appendix to
the 2013 proposed preventive controls rule for examples of food
products that are, or are not, exposed to the environment (78 FR 3646
at 3819). In the context of doing a hazard analysis, the facility must
appropriately determine whether contamination of RTE foods with
pathogenic organisms from the production environment can occur; to make
such an appropriate determination does not require a definition of
``exposed to the environment.''
    (Comment 413) Some comments assert that the proposed requirement to
consider the effect of ``intended or reasonably foreseeable use'' on
the safety of the finished food for the intended consumer is too open-
ended and vague to provide clear direction to industry and regulators
pertaining to compliance obligations. These comments ask us to
substitute ``expected use'' for ``intended or reasonably foreseeable
use.''
    (Response 413) We decline this request. We agree that the term
``expected use'' has potential to communicate both intended use and
reasonably foreseeable use but disagree that this interpretation would
be universal. We are retaining ``intended or reasonably foreseeable
use'' to be explicit that a facility must consider what is reasonably
foreseeable in addition to what is intended. (See also Response 121.)
    (Comment 414) Some comments express concern about the potential for
a hazard evaluation to overlook food allergens and assert that food
allergens must be designated as significant hazards whenever they
occur. Other comments assert that a determination of whether a food
allergen is a significant hazard should consider protein levels in
ingredients. Other comments assert that food allergens are not a
problem in produce, except for tree nuts.
    (Response 414) The hazard identification must consider chemical
hazards, including food allergens (Sec.  117.130(b)(1)(ii)). Thus, food
allergens cannot be overlooked. Whether the protein level of a food
allergen in ingredients is a factor that must be considered in the
hazard evaluation would be determined by the preventive controls
qualified individual who must conduct or oversee the hazard analysis.
We agree that most produce does not satisfy the definition of food
allergen, but the evaluation of whether a food allergen hazard exists
in any particular food still must be considered by the preventive
controls qualified individual

who must conduct or oversee the hazard analysis.
    (Comment 415) Some comments ask us to specify that the hazard
evaluation be more specific about issues relevant to raw materials and
ingredients, including how raw materials are selected and shipped, how
suppliers are evaluated, and how shipments are inspected on receipt.
    (Response 415) We decline this request. When a hazard requiring a
preventive control in a raw material or other ingredient is controlled
before receipt, the receiving facility would address such specifics in
the supply-chain program that would be required as a preventive control
(see subpart G). In addition, the rule already specifies that the
hazard evaluation must consider the effect of raw materials and other
ingredients on the finished food (Sec.  117.130(c)(2)(iii)).
    (Comment 416) Some comments ask us to specify that a hazard
evaluation consider the history of the class of product causing
outbreaks from a particular pathogen.
    (Response 416) We decline this request. The rule already specifies
that the hazard analysis must be based on experience, illness data,
scientific reports, and other information (see Sec.  117.130(a)).
    (Comment 417) Some comments assert that a facility that exports
fresh fruit to the United States should not be required to consider
storage and distribution of the food because storage and distribution
are parts of the supply chain that are not known or controlled by the
supplier. These comments also assert that records showing where the
facility sent the food should suffice when a facility exports fresh
fruit to the United States. Likewise, some comments assert that a
facility that exports fresh fruit to the United States should not be
required to consider intended or foreseeable use because the facility
could not necessarily ascertain the intended or foreseeable use.
    (Response 417) Each facility is part of a complex food supply chain
and a supplier must consider how its food products are likely to be
stored, distributed, and used. For example, entities that transport a
food product generally rely on the shipper (in this case, the facility
exporting the fruit) to provide information relevant to the safe
handling of the food during transport. As another example, a facility
exporting fruit could simply assume that its food product will be
consumed without any processing to reduce any pathogens that may be on
the fruit, unless it knows that its food product is destined for a
commercial processing facility that makes processed fruit products
using processes to adequately control pathogens.
    (Comment 418) Some comments note our previous discussion about
conducting a hazard evaluation for pathogens, including addressing
whether a specific product has been documented to be contaminated with
such pathogens (78 FR 3646 at 3737). These comments ask us to clarify
what we mean by ``documented,'' particularly in the context of a single
incident.
    (Response 418) We expect a facility to take appropriate steps to
remain aware of current reports of food contamination. For example,
such reports are often disseminated through press releases that we post
on our Web site when firms send them to us, and a facility can
subscribe to our service that alerts interested persons to recalls,
market withdrawals, and other safety alerts (Ref. 69). In appropriately
determining whether a pathogen is a hazard requiring a preventive
control, the facility would consider factors such as the severity of
the hazard and the probability that the hazard would occur in the
absence of preventive controls. Whether a single incident warrants
consideration of a pathogen as a hazard requiring a preventive control
may depend on the incident.
    (Comment 419) Some comments ask us to specify that the hazard
analysis consider the impact of a pathogen on high-risk populations.
    (Response 419) We decline this request. The rule requires that a
hazard evaluation consider the severity of the illness or injury if the
hazard were to occur. This evaluation would consider the expected
population of consumers and the severity of consequences when the
expected population is exposed to a pathogen that is a known or
reasonably foreseeable hazard in the food.
    (Comment 420) Some comments assert that the proposed requirements
for hazard evaluation could be interpreted in many ways. For example, a
facility could conclude that the presence of a hand sink or boot dip
prior to entering the processing area will reduce the likelihood of
environmental pathogens and that environmental pathogens are not a
significant hazard, whereas a regulator could interpret this provision
to mean that a facility must always consider an environmental pathogen
to be a significant hazard when the criteria in the provision are met,
unless the facility can provide evidence to the contrary.
    (Response 420) We agree that the requirements for hazard evaluation
are subject to alternative interpretations. This is often the case,
particularly when a regulation is new. The provision specifies that a
facility must evaluate whether an environmental pathogen is a hazard
requiring a preventive control in particular circumstances--i.e.,
whenever an RTE food is exposed to the environment prior to packaging
and the packaged food does not receive a treatment or otherwise include
a control measure (such as a formulation lethal to the pathogen) that
would significantly minimize the pathogen. The written hazard analysis
must be prepared (or its preparation overseen by) a preventive controls
qualified individual (see Sec.  117.126(a)(2) and (b)(1)). The
preventive controls qualified individual for a facility that determines
that an environmental pathogen is not a hazard requiring a preventive
control in such circumstances must document that determination, and a
regulator would consider the adequacy of the facility's documented
determination before reaching a conclusion as to whether the facility
had failed to satisfy the requirements. However, the use of a hand sink
or boot dip prior to entering the processing area to reduce the
likelihood of environmental pathogens may also be considered to be part
of the sanitation controls for the environmental pathogen.
    (Comment 421) Some comments assert that the hazard assessment must
document that the benefits of using a particular chemical outweigh the
potential risks, such as the risks of the chemical causing antibiotic
resistance. Other comments ask us to consider the factors listed in the
provision for potential benefits, as well as risks.
    (Response 421) A hazard is an agent that is reasonably likely to
cause illness or injury in the absence of its control (Sec.  117.3). As
previously discussed, the focus of the requirement on risk (i.e., the
severity of the hazard and the likelihood that it will occur) is
consistent with the NACMCF HACCP guidelines, the Codex HACCP Annex, and
Federal HACCP regulations for seafood, juice, and meat and poultry (78
FR 3646 at 3735). None of these national or international guidelines or
regulations suggest that a risk-benefit analysis is part of a hazard
analysis.
    Moreover, these comments appear to be directed to a determination
by a facility of which raw materials or other ingredients to
intentionally add to a food product rather than to biological,
chemical, or physical hazards that, for example, occur naturally in the
raw materials or other ingredients or may be unintentionally
introduced. Any raw material or other ingredient that a facility adds
to a food product must be lawful. This rule does not address the

criteria for determining whether a particular raw material or other
ingredient is lawful under the applicable statutory provisions (e.g.,
under section 409 of the FD&C Act regarding food additives).
    (Comment 422) Some comments object to the use of sucrose fatty acid
esters as an example (in our previous discussion, 78 FR 3646 at 3737)
for distinguishing between raw materials and ingredients because
sucrose fatty acid esters are an obscure product and the example does
not clearly distinguish between the two terms.
    (Response 422) As discussed in Response 65, we have decided to
return to the phrase ``raw materials and other ingredients'' (rather
than the proposed phrase ``raw materials and ingredients'') throughout
the rule to make it clear that raw materials are ingredients. As a
result, it is not necessary to provide a more broadly applicable
example to distinguish between the terms.
    (Comment 423) Some comments ask us to clarify how the requirements
of this rule apply to transportation practices and assert that a
facility receiving product should not be responsible for hazards in
foods that are not being transported under its custody. Other comments
assert that we should require all entities across the supply chain to
identify food transportation as a critical control point under the
facility's hazard analysis.
    (Response 423) We address specifics about the responsibilities of
shipping facilities and receiving facilities in the 2014 proposed
sanitary transportation rule (79 FR 7006). We will address comments
regarding the responsibilities of shippers and receivers in the final
sanitary transportation rule. For the purpose of the hazard analysis,
whether a particular facility would identify food transportation as a
critical control point through its hazard analysis would depend on the
circumstances, such as whether the food is a TCS food. We expect a
facility that identifies temperature control, including during
transportation, as a preventive control (whether or not as a CCP), to
communicate the need for appropriate temperature control to the person
transporting the food.
    (Comment 424) Some comments ask us to clarify our previous
statements (78 FR 3646 at 3737) regarding whether and how label
information, such as cooking instructions, may be a factor to consider
in a hazard evaluation.
    (Response 424) See Response 390 regarding consumer research about
consumer cooking practices.

XXVI. Subpart C: Comments on Proposed Sec.  117.135--Preventive
Controls

    We proposed requirements to identify and implement preventive
controls to provide assurances that significant hazards will be
significantly minimized or prevented and the food manufactured,
processed, packed, or held by the facility will not be adulterated
under section 402 of the FD&C Act or misbranded under section 403(w) of
the FD&C Act. Some comments support the proposed requirements without
change. For example, some comments agree that preventive controls must
be written and include process controls, food allergen controls,
sanitation controls, a recall plan, and other controls as appropriate
and necessary. Some comments that support the proposed provisions
suggest alternative or additional regulatory text (see, e.g., Comment
428, Comment 431, Comment 432, and Comment 439) or ask us to clarify
how we will interpret the provision (see, e.g., Comment 425, Comment
437, and Comment 440).
    In the following sections, we discuss comments that ask us to
clarify the proposed requirements or that disagree with, or suggest one
or more changes to, the proposed requirements. After considering these
comments, we have revised the proposed requirements as shown in table
31, with editorial and conforming changes as shown in table 52.

                    Table 31--Revisions to the Proposed Requirements for Preventive Controls
----------------------------------------------------------------------------------------------------------------
                 Section                          Description                           Revision
----------------------------------------------------------------------------------------------------------------
117.135(c)(1)...........................  Process controls...........  Clarify that the requirements for process
                                                                        controls depend on the role of the
                                                                        process control in the food safety
                                                                        system.
117.135(c)(2)(i)........................  Food allergen controls.....  Specify that food be protected from
                                                                        allergen cross-contact during handling,
                                                                        as well as during storage.
----------------------------------------------------------------------------------------------------------------

A. Proposed Sec.  117.135(a)--Requirement To Identify and Implement
Preventive Controls

    We proposed that you must identify and implement preventive
controls, including at critical control points, if any, to provide
assurances that significant hazards will be significantly minimized or
prevented and the food manufactured, processed, packed, or held by your
facility will not be adulterated under section 402 of the FD&C Act or
misbranded under section 403(w) of the FD&C Act. We also proposed that
these preventive controls include controls at CCPs, if there are any
CCPs, and controls, other than those at CCPs, that are also appropriate
for food safety.
    Some comments support the flexibility provided to facilities to
implement preventive controls that are appropriate to the facility and
the food. Other comments support the clarification, in the 2014
supplemental human preventive controls rule, that not all preventive
controls are established at CCPs and that some food safety plans will
have not CCPs. We are finalizing the provision as proposed with the
editorial and conforming changes in table 52.

B. Proposed Sec.  117.135(b)--Requirement for Written Preventive
Controls

    We proposed that preventive controls must be written.
    (Comment 425) Some comments from the almond industry explain that
USDA's regulations for a mandatory program for reduction of Salmonella
on almonds require almond handlers (facilities) to subject almonds to a
process that delivers a minimum 4-log destruction of Salmonella. The
process can be applied by the almond handler (facility) or off-site at
a ``custom processor.'' These comments agree that preventive controls
should be written, but ask us to clarify whether documentation of
treatment by its ``custom processor'' would be accepted as a ``written
preventive control'' when the ``custom processor'' controls the hazard.
    (Response 425) The question posed by these comments highlights the
difference between the records required in the food safety plan and the
records documenting the implementation of the food safety plan. The
``written preventive controls'' are part of the food safety plan,
whereas the records

documenting treatment are implementation records. Implementation
records documenting treatment, whether by a facility or its ``custom
processor,'' would not satisfy the requirements for written preventive
controls. However, specifying that the preventive control for a
specific hazard is a particular treatment by a ``custom processor,''
along with information that describes the treatment, would satisfy the
requirement for written preventive controls.

C. Proposed Sec.  117.135(c)(1)--Process Controls

    We proposed that preventive controls include process controls as
appropriate to the facility and the food. Process controls include
procedures, practices, and processes to ensure the control of
parameters during operations such as heat processing, acidifying,
irradiating, and refrigerating foods. Process controls must include, as
appropriate to the applicable control, parameters associated with the
control of the hazard, and the maximum or minimum value, or combination
of values, to which any biological, chemical, or physical parameter
must be controlled to significantly minimize or prevent a significant
hazard.
    (Comment 426) Some comments state that assigning a parameter and
associated minimum and maximum values for some process controls (such
as refrigeration (including freezing), baking, or water activity) may
be possible, but not be necessary for food safety. These comments ask
us to require minimum and maximum values to be assessed against the
applicable food safety need, or otherwise make clear that the
implications of not controlling minimum and maximum values must be
assessed in light of the circumstances. Other comments express concern
that ``as appropriate to the applicable control'' could be interpreted
as suggesting that if it is merely feasible to establish parameters for
a process control, they must be established. Other comments express
concern that the proposed requirement suggests that if a parameter is
not ``controlled,'' a regulator could conclude that the facility is not
in compliance with the rule because it necessarily has not
significantly minimized or prevented a significant hazard.
    One comment provides two examples of refrigeration controls to
explain its view that the management components for refrigeration
controls will vary depending on the role of refrigeration within the
facility's overall food safety system. (See Comment 455.) This comment
also provides an example to make a point that water activity may not be
necessary for food safety even when maximum or minimum values are
assigned. In this example, a parameter for water activity could be set
at less than 0.85 based on the control of Staphylococcus aureus, but
such a parameter would not be necessary for food safety for a product
such as a dry seasoning blend that has a water activity of 0.2-0.3.
This comment also notes that when there are many different controls
working together to minimize or prevent one hazard simultaneously (such
as a formulation that uses a combination of moisture, pH, titratable
acidity, and salt level), noncompliance with any one parameter will not
necessarily result in an unsafe product.
    (Response 426) See Response 455. We have revised the regulatory
text to specify that process controls must include parameters and
minimum or maximum values as appropriate to both the nature of the
applicable control and its role in the facility's food safety system.
    (Comment 427) Some comments ask us to delete the phrase ``to
significantly minimize or prevent a significant hazard.''
    (Response 427) We decline this request. ``Significantly minimize or
prevent a significant hazard'' (which we have revised to
``significantly minimize or prevent a hazard requiring a preventive
control'') is the standard for controlling the hazards. Although the
phrase could be viewed as redundant with the standard in the
requirement to identify and implement preventive controls (Sec.
117.135(a)(1)), repeating that standard in the requirements for
parameters and the minimum or maximum values associated with control of
the hazard emphasizes the standard, which is appropriate for process
controls.

D. Proposed Sec.  117.135(c)(2)--Food Allergen Controls

    We proposed that preventive controls include, as appropriate to the
facility and the food, food allergen controls that include those
procedures, practices, and processes employed for ensuring protection
of food from allergen cross-contact, including during storage and use,
and for labeling the finished food, including ensuring that the
finished food is not misbranded under section 403(w) of the FD&C Act.
    (Comment 428) Some comments ask us to specify that food be
protected from allergen cross-contact during handling, as well as
during storage.
    (Response 428) We have revised the provision as requested by the
comments.
    (Comment 429) Some comments assert that food allergen controls
should be based on hazard analysis and risk. Other comments provide
examples of existing industry guidance that addresses food allergen
controls. Some comments note that food allergen controls are addressed
in the PMO (e.g., Appendix K, the voluntary HACCP program).
    Other comments assert that establishing food allergen controls at
this time is premature or that food allergen controls need to be
balanced with pathogen controls. Some comments ask us to clarify
whether the standard that would be established for food allergen
controls is ``absolutely allergen free.''
    (Response 429) We have acknowledged that it is premature to require
validation of food allergen controls (see 78 FR 3646 at 3755 and
Response 515). However, we disagree that requiring a facility to
establish food allergen controls as a preventive control is premature
at this time, as evidenced by the existing industry guidance, and
requirements of programs such as Appendix K of the PMO, submitted by
comments. We agree that whether a facility appropriately determines
that food allergen controls are necessary will be based on the outcome
of the hazard analysis (see the requirements for hazard analysis in
Sec.  117.130(a) and (c)). A facility that already has established food
allergen controls based on recommendations in industry guidelines or
requirements of programs such as the voluntary HACCP program of the PMO
can incorporate those established food allergen controls into its own,
facility-specific food safety plan, and rely on its existing records
for those food allergen controls to demonstrate compliance with the
requirements of this rule (see Sec.  117.330). Whether a facility needs
to establish food allergen controls in addition to pathogen controls
depends on the outcome of the facility's hazard analysis; a facility
that determines that both allergens and pathogens are hazards requiring
a preventive control in the manufacturing, processing, packing, or
holding of a food product must address both hazards.
    The requirements for food allergen controls do not establish a
particular standard. In general, when we do establish a standard we
avoid ``absolute'' standards such as the ``absolutely allergen free''
standard mentioned by the comment.
    We appreciate receiving examples of food allergen control guides.
    (Comment 430) Some comments ask us to revise the proposed
requirement from ``food allergen controls must

include'' to ``food allergen controls include.''
    (Response 430) In the 2014 supplemental human preventive controls
notice, we proposed a series of revisions to the overall framework of
the requirements for hazard analysis and risk-based preventive
controls, including revisions to the requirements for preventive
controls to emphasize that the preventive controls that a facility must
establish and implement are those appropriate to the facility and the
food (79 FR 58524 at 58541-58543). With respect to food allergen
controls, we proposed to first specify what food allergen controls
``include'' (i.e., procedures, practices, and processes to control food
allergens), as requested by these comments. However, we also proposed
to continue to specify minimum requirements for what food allergen
controls must include when a facility determines that a food allergen
is a hazard requiring a preventive control--i.e., those procedures,
practices, and processes employed for ensuring protection of food from
allergen cross-contact and for labeling the finished food.
    To the extent that these comments are asking us to clarify the
distinction between a description of what constitutes a food allergen
control and the minimum requirements for what food allergen controls
must include when a facility determines that a food allergen is a
hazard requiring a preventive control, the regulatory text we proposed
in the 2014 supplemental human preventive controls notice modified the
regulatory text as requested. However, to the extent that these
comments are asking us to modify the provision so that it no longer
establishes the minimum requirements for what food allergen controls
must include when a facility determines that a food allergen is a
hazard requiring a preventive control, we disagree. The listed minimum
requirements are consistent with long-standing approaches to the
control of food allergens and provide flexibility for a facility to
identify and implement those procedures, practices, and processes most
suited to the control of food allergen hazards in light of the facility
and its food products (Ref. 70) (Ref. 71); see also the discussion at
78 FR 3646 at 3741.
    (Comment 431) Some comments ask us to revise the requirement that
food allergen controls must include labeling controls by adding the
phrase ``to ensure that major food allergens are properly disclosed.''
    (Response 431) We decline this request. The provision requires that
the procedures, practices, and processes employed for labeling the
finished food include those for ensuring that the finished food is not
misbranded under section 403(w) of the FD&C Act. Requiring that
labeling procedures, practices, and processes ensure that major food
allergens are properly disclosed would be redundant with the proposed
requirement that they ensure that the finished food is not misbranded
under section 403(w).
    (Comment 432) Some comments ask us to revise the requirement that
food allergen controls must include labeling controls by adding the
phrase ``as appropriate'' because section 201(qq)(2)(A) of the FD&C Act
excludes highly refined oils from the definition of ``major food
allergen.''
    (Response 432) We decline this request because qualifying that the
requirement applies ``as appropriate'' is not necessary to achieve the
outcome requested by the rule comments. If a food ingredient, such as a
highly refined oil, is not a major food allergen, it is not subject to
the requirements for food allergen controls.
    (Comment 433) Some comments assert that quantification or
measurement of specific parameters is not appropriate for some food
allergen controls.
    (Response 433) We agree with these comments. In the 2014
supplemental human preventive controls notice, we clarified that the
requirements for parameters and maximum and minimum values apply to
process controls.
    (Comment 434) Some comments ask us to establish thresholds for food
allergens. Other comments assert that we should not have a ``zero-
tolerance'' approach to food allergens. Some comments ask us to require
advisory labeling (such as a label statement that a food that does not
contain an allergen ingredient was processed in a facility that also
processes foods that do have specific allergen ingredients) if we do
not establish a ``zero-tolerance'' policy for food allergen controls.
Other comments assert we should allow advisory labeling in light of
difficulties in developing food allergen controls.
    (Response 434) In 2008, we announced a public hearing on the use of
advisory labeling of allergens in foods as part of a long-term strategy
to help manufacturers use allergen advisory labeling that is truthful
and not misleading, conveys a clear and uniform message, and adequately
informs food-allergic consumers and their caregivers (73 FR 46302,
October 8, 2008). In that document, we explained our concerns with food
allergens, including food allergens inadvertently incorporated into
manufactured foods, due to the number of reports concerning consumers
who have experienced adverse reactions following exposure to an
allergenic substance in a food. We also described our previous actions
targeting food manufacturers, including: (1) A notice to manufacturers
entitled ``Label Declaration of Allergenic Substances in Foods'' in
1996 (Ref. 72); (2) an FDA/state partnership to increase industry's
understanding of food allergens and to identify effective manufacturing
controls (Ref. 73); and (3) a statement of policy, to our staff,
regarding food allergens (Ref. 74).
    In 2012, we requested comments relevant to conducting a risk
assessment to establish regulatory thresholds for major food allergens
as defined in FALCPA (77 FR 74485, December 14, 2012). We noted that
regulatory thresholds would help industry to conduct allergen hazard
analyses and develop standards for evaluating the effectiveness of
allergen preventive controls.
    However, establishing regulatory policy or requirements, such as a
long-term strategy regarding use of allergen advisory labeling, or a
specific threshold for a food allergen or a ``zero-tolerance'' policy,
is outside the scope of this rule. The provisions of this rule, whether
the CGMPs in subpart B or the requirements for hazard analysis and
risk-based preventive controls in subparts C and G, are directed to
procedures, practices, and processes for the safe manufacturing,
processing, packing, and holding of food rather than to special
labeling policies or specific levels of substances (such as food
allergens) that would render food adulterated or misbranded.
    (Comment 435) Some comments assert that food allergen controls need
not be required in specific situations, such as during the storage and
transport of coffee and the storage of packaged foods not exposed to
the environment.
    (Response 435) Whether food allergen controls are necessary in any
particular circumstance depends on the outcome of the facility's hazard
analysis. Although coffee is not a food allergen, whether coffee
requires food allergen controls during storage and transport depends on
factors such as how the coffee is stored and transported and whether
there is potential for allergen cross-contact. Although we agree that
the potential for allergen cross-contact during the storage of packaged
foods not exposed to the environment is low, it is the responsibility
of the preventive controls qualified individual who conducts or
oversees the hazard analysis

to make an appropriate determination for an individual facility.
    (Comment 436) Some comments assert that implementation of food
allergen controls poses particular challenges in the context of milling
operations. As an example, these comments explain that most milling
operations do not handle soy. However, allergen cross-contact between
grains and soy can occur at various points in the chain of production
and transport, such that grains arriving at a milling facility might
already contain low levels of soy. These comments also assert that the
presence in a desired grain of low levels of soy or of other grains is
consistent with U.S. Grain Standards. For example, the Grain
Inspection, Packers and Stockyards Administration (GIPSA) definition of
corn allows for the presence of between 2 percent and 7 percent foreign
material, depending on the grade of corn, and the presence of up to 10
percent of other grains for which standards have been set. Although
millers use equipment that helps to separate the desired grain from soy
or other grains, these comments assert that complete elimination of soy
and other grains is not practicable even under CGMP. These comments ask
us to acknowledge that complete elimination of allergen cross-contact
is not feasible in certain operations even under CGMP and that the
intermittent presence of undeclared allergens is possible in certain
foods, notwithstanding the observance of CGMP.
    (Response 436) We acknowledge that GIPSA standards may allow for
the presence of foreign material, and that foreign material could be a
food allergen such as soy. However, such standards are not
determinative as to whether hazards requiring a preventive control will
be significantly minimized or prevented and the food manufactured,
processed, packed, or held by a facility will not be adulterated under
section 402 of the FD&C Act or misbranded under section 403(w) of the
FD&C Act. Thus, as the comments point out, grains that arrive at a
facility for milling may contain levels of a food allergen that a
milling operation would not be able to eliminate. In circumstances such
as these, supply-chain controls directed to the supplier's cleaning
procedures, in addition to separation techniques applied at milling,
may be necessary to enable the milling operation to satisfy its
responsibilities under this rule. For example, a supplier that uses
storage bins to hold soybeans at some times and corn at other times
could agree to additional ``cleaning'' of bins previously used to store
soybeans by ``scouring'' the bin with corn before using the bin to hold
corn intended for human consumption. The corn used for scouring would
be handled appropriately--e.g., by diverting to use in animal food,
because food allergens are not hazards requiring a preventive control
in food for animals. Doing so would reduce the potential for residual
soybeans to be present in the next lot of corn, sold for human
consumption.
    (Comment 437) Some comments ask us to clarify when a facility would
be expected to establish food allergen controls rather than rely on the
CGMP requirements (in subpart B) to prevent allergen cross-contact,
particularly for oilseed processors who only need to address soy
allergens.
    (Response 437) Food allergen controls are applicable to facilities
that handle any of the foods that are food allergens. Any facility that
handles a single food allergen, such as a processor only handling
soybeans to make soybean oil, may simply need to ensure that the
products it ships into commerce are labeled with the food allergen. (If
the oils are highly refined and do not contain soy proteins, the
facility may need to prevent cross-contact with less highly refined
oils that may contain soy proteins.) If the facility only produces
foods that contain the single food allergen, there would not be any
foods for which cross-contact could occur. For facilities that handle
more than one allergen-containing food or both foods that contain a
specific food allergen along with foods that do not contain that food
allergen (such as a facility that roasts almonds, macadamia nuts, and
cashews), the facility could establish preventive controls to ensure
that common equipment is cleaned between each type of nut. The facility
could use CGMPs to ensure that the different nuts are stored separately
before and after roasting to prevent cross-contact.
    (Comment 438) Some comments ask us to confirm that FSMA does not
change prior agency guidance on the reasonable steps that should be
taken to prevent allergens from being unintentionally incorporated into
the food and the limited use of allergen advisory statements where the
risk of allergen cross-contact cannot be eliminated through CGMPs.
    (Response 438) Prior agency guidance on the reasonable steps that
should be taken to prevent allergens from being unintentionally
incorporated into the food and the limited use of allergen advisory
statements is still applicable. (See also the discussion in Response
434.)

E. Proposed Sec.  117.135(c)(3)--Sanitation Controls

    We proposed that preventive controls include, as appropriate to the
facility and the food, sanitation controls that include procedures,
practices, and processes to ensure that the facility is maintained in a
sanitary condition adequate to significantly minimize or prevent
hazards such as environmental pathogens, biological hazards due to
employee handling, and food allergen hazards. We also proposed that
sanitation controls must include procedures, practices, and processes
for the cleanliness of food-contact surfaces, including food-contact
surfaces of utensils and equipment, and procedures for the prevention
of allergen cross-contact and cross-contamination from insanitary
objects and from personnel to food, food packaging material, and other
food-contact surfaces and from raw product to processed product.
    (Comment 439) Some comments ask us to use the term ``primary
packaging material'' rather than ``food packaging material.''
    (Response 439) We decline this request. See Response 166, in which
we discuss what we mean by ``food packaging material'' (e.g., we do not
intend the term ``food-packaging materials'' to include shipping
containers such as cartons and crates that pose no risk of introducing
contaminants or food allergens into food).
    (Comment 440) Some comments ask us to clarify whether the
requirements for sanitation controls apply to all food facilities or
only to those that make RTE products.
    (Response 440) The requirements for sanitation controls apply to
all food facilities, not just those that make RTE products. The
facility must determine through its hazard analysis when sanitation
controls are necessary to address a hazard requiring a preventive
control. It is reasonable to assume that sanitation controls will be
more common in facilities that make RTE products than in facilities
that make non-RTE products.
    (Comment 441) Some comments assert that sanitation controls are not
necessary to prevent any hazards in distribution facilities where food-
contact surfaces are not present. Other comments assert that sanitation
controls should be required in all cases (rather than ``as
appropriate'') given their central importance.
    (Response 441) Under the framework established by FSMA--and
implemented in this rule--each facility determines through its hazard
analysis

when sanitation controls are necessary to control a hazard requiring a
preventive control. The rule neither establishes circumstances (such as
in distribution centers) where sanitation controls are not necessary
nor pre-judges whether sanitation controls are necessary in specific
circumstances. Although we do not expect that facilities such as
distribution centers would determine through their hazard analysis that
sanitation controls are required, we do expect all food establishments
that are subject to the CGMP requirements established in subpart B to
fully comply with applicable requirements for sanitation.

F. Proposed Sec.  117.135(c)(4)--Supply-Chain Controls

    We proposed that supplier controls include the supplier program.
See the discussion of comments on the supplier program, now in subpart
G, in sections XLII through XLIX. As discussed in more detail in
section XLII, we have revised the phrase ``supplier program'' to
``supply-chain program'' throughout the regulatory text. As a companion
change, we have revised Sec.  117.135(c)(4) to refer to ``supply-chain
controls'' rather than ``supplier controls.''

G. Proposed Sec.  117.135(c)(5)--Recall Plan

    We proposed that preventive controls include, as appropriate, a
recall plan as would be required by proposed Sec.  117.137. See the
discussion of comments on the recall plan (final Sec.  117.139) in
section XXVIII.

H. Proposed Sec.  117.135(c)(6)--Other Controls

    We proposed that preventive controls include any other procedures,
practices, and processes necessary to satisfy the requirements of Sec.
117.135(a). Examples of other controls include hygiene training and
other current good manufacturing practices.
    (Comment 442) Some comments ask us to specify that preventive
controls include controls on raw materials and other ingredients.
    (Response 442) The final rule specifies that preventive controls
include supply-chain controls as appropriate to the facility and the
food. The request of these comments is addressed by the requirements
for the supply-chain program (see Sec.  117.135(c)(4) and subpart G).
    (Comment 443) Some comments refer to our discussion that an example
of an ``other'' preventive control could include temperature control
for a TCS refrigerated food, and our discussion that although many
refrigerated foods only require refrigeration for food quality, some
refrigerated foods do require refrigeration for food safety (78 FR 3646
at 3744). These comments ask us to be clearer about foods that require
refrigeration for food quality rather than for food safety.
    (Response 443) Additional information about foods that do not
require refrigeration for food safety is available in the Food Code
(Ref. 51) (see, e.g., the definition of TCS food and the examples of
foods that are not TCS foods in section 1-2 of the Food Code).

XXVII. Subpart C: Circumstances in Which the Owner, Operator, or Agent
in Charge of a Manufacturing/Processing Facility Is Not Required To
Implement a Preventive Control (Final Sec. Sec.  117.136 and 117.137)

    In the 2014 supplemental human preventive controls notice, we
provided an opportunity for public comment on potential requirements
for a supplier program as a preventive control, including comments on
when a supplier program would not be required. As discussed in more
detail in section XLII, we have revised the phrase ``supplier program''
to ``supply-chain program'' throughout the regulatory text. As
summarized in table 32 and discussed more fully in the following
paragraphs, after considering comments on when a supplier program would
not be required, we are establishing two new provisions. Although both
provisions have an effect on the required supply-chain program, they
would be implemented outside the framework of a supply-chain program.

     Table 32--Summary of Applicable Provisions Regarding When the Owner, Operator, or Agent in Charge of a
               Manufacturing/Processing Facility Is Not Required to Implement a Preventive Control
----------------------------------------------------------------------------------------------------------------
                                     Proposed section
    Final section designation           designation                  Description                   Revision
----------------------------------------------------------------------------------------------------------------
117.136(a)(1)....................  N/A.................  A manufacturer/processor is not     N/A.
                                                          required to implement a
                                                          preventive control if it
                                                          determines and documents that the
                                                          type of food (e.g., RACs such as
                                                          cocoa beans, coffee beans, and
                                                          grains) could not be consumed
                                                          without application of an
                                                          appropriate control.
117.136(a)(2)....................  117.136(a)(1)(ii)(C)  A manufacturer/processor is not     Includes a
                                                          required to implement a             requirement for
                                                          preventive control if it relies     documentation that
                                                          on its customer who is subject to   the food is ``not
                                                          the requirements for hazard         processed to
                                                          analysis and risk-based             control
                                                          preventive controls in subpart C    [identified
                                                          to ensure that the identified       hazard].''
                                                          hazard will be significantly
                                                          minimized or prevented and both
                                                          (1) discloses in documents
                                                          accompanying the food that the
                                                          food is ``not processed to
                                                          control [identified hazard]'' and
                                                          (2) annually obtains from its
                                                          customer written assurance that
                                                          the customer has established and
                                                          is following procedures that will
                                                          significantly minimize or prevent
                                                          the identified hazard.
117.136(a)(3)....................  N/A.................  A manufacturer/processor is not     N/A.
                                                          required to implement a
                                                          preventive control if it relies
                                                          on its customer who is not
                                                          subject to the requirements for
                                                          hazard analysis and risk-based
                                                          preventive controls in subpart C
                                                          to provide assurance it is
                                                          manufacturing, processing, or
                                                          preparing the food in accordance
                                                          with applicable food safety
                                                          requirements and it: (1)
                                                          Discloses in documents
                                                          accompanying the food, in
                                                          accordance with the practice of
                                                          the trade, that the food is ``not
                                                          processed to control [identified
                                                          hazard]''; and (2) annually
                                                          obtains from its customer written
                                                          assurance that it is
                                                          manufacturing, processing, or
                                                          preparing the food in accordance
                                                          with applicable food safety
                                                          requirements.

117.136(a)(4)....................  117.136(a)(1)(ii)(C)  A manufacturer/processor is not      Addresses
                                                          required to implement a             the circumstance
                                                          preventive control if it relies     where an entity
                                                          on its customer to ensure that      (other than the
                                                          the food will be processed to       facility's
                                                          control the identified hazard by    customer) in the
                                                          an entity in the distribution       distribution chain
                                                          chain subsequent to the customer    controls the
                                                          and both: (1) Discloses in          hazard.
                                                          documents accompanying the food     Includes a
                                                          that the food is ``not processed    requirement for
                                                          to control [identified hazard]''    documentation that
                                                          and (2) annually obtains from its   the food is ``not
                                                          customer written assurance that     processed to
                                                          the customer will both disclose     control
                                                          the information that the food is    [identified
                                                          ``not processed to control          hazard].''
                                                          [identified hazard]'' and will
                                                          only sell to another entity that
                                                          agrees, in writing, it will
                                                          follow procedures that will
                                                          significantly minimize or prevent
                                                          the identified hazard (if the
                                                          entity is subject to the
                                                          requirements for hazard analysis
                                                          and risk-based preventive
                                                          controls in subpart C) or
                                                          manufacture, process, or prepare
                                                          the food in accordance with
                                                          applicable food safety
                                                          requirements (if the entity is
                                                          not subject to the requirements
                                                          for hazard analysis and risk-
                                                          based preventive controls in
                                                          subpart C), or obtain a similar
                                                          written assurance from the
                                                          entity's customer.
117.136(a)(5)....................  N/A.................  A manufacturer/processor is not     N/A.
                                                          required to implement a
                                                          preventive control if it has
                                                          established, documented, and
                                                          implemented a system that ensures
                                                          control, at a subsequent
                                                          distribution step, of the hazards
                                                          in the food product it
                                                          distributes and documents the
                                                          implementation of that system.
117.136(b).......................  117.136(g)(3).......  Records documenting the applicable  Includes a
                                                          circumstances in Sec.               requirement for
                                                          117.136(a).                         documentation of
                                                                                the additional
                                                                                circumstances in
                                                                                which a
                                                                                manufacturer/
                                                                                processor is not
                                                                                required to
                                                                                implement a
                                                                                preventive
                                                                                control.
117.137..........................  N/A.................  A facility that provides a written  N/A.
                                                          assurance under Sec.
                                                          117.136(a)(2), (3), or (4) must
                                                          act consistently with the
                                                          assurance and document its
                                                          actions taken to satisfy the
                                                          written assurance.
----------------------------------------------------------------------------------------------------------------

    The first provision allows a manufacturer/processor to not
implement a preventive control if the manufacturer/processor determines
and documents that the type of food (e.g., RACs such as cocoa beans,
coffee beans, and grains) could not be consumed without application of
the appropriate control (see Sec.  117.136(a)(1)). We describe comments
leading to this provision, and our response to those comments, in
Comment 444 and Response 444, respectively. Although we are
establishing these provisions outside the framework of the supply-chain
program, these provisions continue to play a role in the requirements
for a supply-chain program, because they also provide an exception to
the requirements for a manufacturer/processor to establish and
implement a supply-chain program.
    The second provision relates to comments we received on a proposed
exception to the requirement for a manufacturer/processor to establish
and implement a supplier program (proposed Sec.  117.136(a)(1)(ii)(C)).
(See Comment 445.) Under proposed Sec.  117.136(a)(1)(ii)(C), a
receiving facility would not have been required to have a supplier
program if it relied on its customer to control the hazard and annually
obtained from its customer written assurance that the customer has
established and is following procedures (identified in the written
assurance) that will significantly minimize or prevent the hazard. As
discussed in Response 445, we are replacing this provision with several
provisions that apply when a manufacturer/processor identifies a hazard
requiring a preventive control (``identified hazard''), does not
control the identified hazard, but can demonstrate and document that
the identified hazard will be controlled by an entity in its
distribution chain. A manufacturer/processor that satisfies the
criteria in these provisions will not be required to implement a
preventive control for the identified hazard. Under these provisions,
the combination of three requirements will provide adequate assurance
that the food will be processed to control the identified hazard before
it reaches consumers. These requirements are: (1) Documentation
provided by the manufacturer/processor to its direct customer that the
food is ``not processed to control [identified hazard]''; (2) written
assurance from customers regarding appropriate procedures to ensure
that the food will receive further processing to control the identified
hazards; and (3) provisions relating to accountability for written
assurances. (In these provisions, ``customer'' means a commercial
customer, not a consumer.)
    (Comment 444) Some comments express concern about the ability for
distributors/cooperatives to identify the individual farms that
harvested the produce when such farms are more than one step back in
the food chain from the distributor/cooperative. Some comments assert
that receiving facilities should not be required to verify suppliers
with which they do not have a direct commercial relationship. These
comments note that, in the case of the cocoa bean supply chain, the
processing facility likely has no direct relationship with the
thousands of farms involved in the growing and harvesting of the beans.
Some comments ask for an exemption from supplier verification
activities for foods such as cocoa beans because,

although cocoa processors do not currently rely on farms to control
hazards, and would therefore not need to verify farms, it is
problematic to have a requirement that potentially could necessitate
traceback to farms.
    (Response 444) We are establishing a provision, applicable to both
the supply chain and the distribution chain of a manufacturer/
processor, for a circumstance when a manufacturer/processor does not
need to implement a preventive control. The specific food product
identified by some of the comments (i.e., cocoa beans) is part of a
class of food products (principally RACs) that could simply not be
eaten without processing that would control the hazards requiring a
preventive control. Other RACs in this class of food products are
coffee beans, grains, and some RACs that are rarely consumed raw.
Therefore, we are providing that a manufacturer/processor does not need
to implement a preventive control if it determines and documents that
the type of food (e.g., RACs such as cocoa beans, coffee beans, and
grains) could not be consumed without application of the appropriate
control (see Sec.  117.136(a)(1)). The regulatory text does not specify
RACs ``rarely consumed raw'' because ``rarely consumed raw'' is not the
same as ``could not be consumed without application of the appropriate
control.'' However, depending on the facility, the RAC, and the food
produced by the manufacturer/processor, there may be some circumstances
where a manufacturer/processor could determine that a particular RAC
that passes through its facility satisfies the criterion ``could not be
consumed without application of the appropriate control.''
    In other cases, a facility that conducts a manufacturing/processing
activity on produce rarely consumed raw may satisfy the criteria in
other new provisions (Sec.  117.136(a)(2), (3), and (4)) in which it
relies on its customer to provide assurance that the food will be
processed to control the identified hazard. In still other cases, such
a facility may have determined through its hazard analysis that there
are no hazards requiring a preventive control, and will not consider
whether one of the circumstances in new Sec.  117.136 apply.
    As a consequential addition, new Sec.  117.136(b) specifies the
records that a manufacturer/processor would need to satisfy the
documentation requirements established in new Sec.  117.136(a)(1), and
we have added new Sec.  117.136(b) to the list of implementation
records (Sec.  117.190) that are subject to the recordkeeping
requirements of subpart F.
    See also Comment 657, in which we discuss comments asking us to add
flexibility to the requirements for a supply-chain program such that
any entity other than the receiving facility can perform supplier
verification activities. As discussed in Response 657, the rule
provides additional flexibility in the supply-chain program with regard
to who can perform certain activities (see Sec.  117.415).
    (Comment 445) Some comments ask us to delete the criterion for
control of the hazard by the receiving facility's customer, with annual
written assurance that the customer had established and was following
procedures (identified in the written assurance) that would
significantly minimize or prevent the hazard. The stated reasons
varied. For example, some comments state that a receiving facility may
have so many customers that it is not possible to obtain written
assurance annually from all customers. Other comments express concern
that a customer may be unwilling to describe confidential trade secrets
in order to identify in writing the procedures the customer has
established and is following to control the hazard. Other comments
express concern about ``legal issues'' when a receiving facility needs
to assess the adequacy of the customers' procedures for controlling a
hazard because under current business practices a vendor can provide
assurance to a buyer (its customer), but buyers do not typically
provide such assurance to vendors. Some comments express concern that
written assurance does not guarantee that the customer is actually
doing anything to significantly minimize or prevent the hazard.
    Some comments ask us to provide an alternative that would allow the
receiving facility to provide documentation to its customer about a
hazard that needs a preventive control at a processing facility later
in the distribution chain rather than obtain written assurance that its
customer will control a hazard. If written assurance must be required,
these comments ask us to allow the written assurance provided by the
customer to state that the customer would evaluate the hazard and if
necessary establish and follow procedures to significantly minimize or
prevent the hazard.
    Some comments state the receiving facility may not know the
identity of all its ultimate customers, particularly if the receiving
facility sells its products to a distributor who then sells to other
entities. Some comments ask us to provide flexibility for facilities to
determine whether annual updates of written assurance are necessary.
Other comments ask us to specify that a receiving facility need not
establish and implement a supplier program for raw materials and
ingredients that are RACs intended for further processing.
    Some comments assert that the presence of low levels of pathogens
on a raw product that will be subject to a lethal process further
downstream does not pose a risk to the consumer, and should not be
considered a significant hazard (i.e., a hazard requiring a preventive
control). These comments also assert that if we maintain that
Salmonella contamination is a significant hazard for each member of the
supply chain, then we should allow the preventive control to be applied
in a subsequent step at another facility. Other comments ask us to
clarify that a facility would not need to develop preventive controls
where it produces raw materials or ingredients that are subject to
subsequent processing that will address known or reasonably foreseeable
hazards.
    (Response 445) We are establishing several provisions, specifically
applicable to the distribution chain of a manufacturer/processor, for
circumstances when a manufacturer/processor does not need to implement
a preventive control (Sec. Sec.  117.136(a)(2), (a)(3), (a)(4) and
(a)(5), (b)(2), (b)(3), (b)(4), and (b)(5), 117.137, and 117.335). See
Response 444 for another new provision that applies to the supply chain
in addition to the distribution chain (Sec.  117.136(a)(1)).
    Under the first of these provisions (Sec.  117.136(a)(2)), a
manufacturer/processor is not required to implement a preventive
control if it relies on its customer (who is subject to the
requirements for hazard analysis and risk-based preventive controls in
subpart C) to ensure that the identified hazard will be significantly
minimized or prevented and: (1) Discloses in documents accompanying the
food, in accordance with the practice of the trade, that the food is
``not processed to control [identified hazard]''; and (2) annually
obtains from its customer written assurance, subject to the
requirements of Sec.  117.137, that the customer has established and is
following procedures (identified in the written assurance) that will
significantly minimize or prevent the hazard. The manufacturer/
processor would include the specific hazard requiring a preventive
control (e.g., Salmonella) where the statement says ``[identified
hazard].'' A facility that provides the written assurance must act
consistently with the assurance and document its

actions taken to satisfy the written assurance (see new Sec.  117.137).
The documents could be bills of lading or other papers that accompany
the food, or labels on the containers of the food.
    Under the second of these provisions, (Sec.  117.136(a)(3)), a
manufacturer/processor is not required to implement a preventive
control if it relies on its customer (who is not subject to the
requirements for hazard analysis and risk-based preventive controls in
subpart C) to provide assurance it is manufacturing, processing, or
preparing the food in accordance with applicable food safety
requirements and it: (1) Discloses in documents accompanying the food,
in accordance with the practice of the trade, that the food is ``not
processed to control [identified hazard]''; and (2) annually obtains
from its customer written assurance that it is manufacturing,
processing, or preparing the food in accordance with applicable food
safety requirements. By ``customer who is not required to implement
preventive controls under part 117'' we mean entities such as qualified
facilities and retail food establishments.
    Under the third of these provisions (Sec.  117.136(a)(4)), a
manufacturer/processor is not required to implement a preventive
control if it relies on its customer to provide assurance that the food
will be processed to control the identified hazard by an entity in the
distribution chain subsequent to the customer and: (1) Discloses in
documents accompanying the food, in accordance with the practice of the
trade, that the food is ``not processed to control [identified
hazard]''; and (2) annually obtains from its customer written
assurance, subject to the requirements of Sec.  117.137, that the
customer will disclose in documents accompanying the food, in
accordance with the practice of the trade, that the food is ``not
processed to control [identified hazard]''. The manufacturer/processor
also must obtain written assurance that its customer will only sell to
another entity that agrees, in writing, it will: (1) Follow procedures
(identified in a written assurance) that will significantly minimize or
prevent the hazard (if the entity is subject to the requirements for
hazard analysis and risk-based preventive controls in subpart C), or
manufacture, process, or prepare the food in accordance with applicable
food safety requirements (if the entity is not subject to the
requirements for hazard analysis and risk-based preventive controls in
subpart C); or (2) obtain a similar written assurance from the entity's
customer.
    Under the fourth of these provisions (Sec.  117.136(a)(5)), a
manufacturer/processor is not required to implement a preventive
control if it has established, documented, and implemented a system
that ensures control, at a subsequent distribution step, of the hazards
in the food product it distributes and documents the implementation of
that system. Comments did not provide examples of such a system, but we
do not want to preclude the development of such systems.
    We have added several other requirements related to these new
provisions that we are specifically establishing as circumstances in
which a manufacturer/processor need not implement a preventive control.
As already noted in this response, new Sec.  117.137 requires that a
facility that provides a written assurance must act consistently with
the assurance and document its actions taken to satisfy the written
assurance. In addition, new Sec.  117.136(b)(2), (3), (4), and (5)
specify the records that a manufacturer/processor would need to satisfy
the documentation requirements established in new Sec.  117.136(a)(2),
(3), (4), and (5), and new Sec.  117.335 establishes requirements
applicable to the written assurance between a manufacturer/processor
and its customer. Taken together, the provisions of Sec. Sec.  117.137
and 117.335 establish legal responsibilities for a facility that
provides a written assurance under Sec.  117.136(a)(2), (3), or (4),
even if that facility is not a manufacturer/processor.
    The point of these provisions is to ensure that hazards that a
manufacturer/processor has determined, through its hazard analysis,
require a preventive control, but are not controlled in the supply
chain before the manufacturer/processor or by the manufacturer/
processor, are in fact controlled by a subsequent entity in the
distribution chain. With the assurance from the first manufacturer/
processor's customer that the hazards will be controlled after the food
product leaves the manufacturer/processor, it is not necessary for the
first manufacturer/processor to implement the applicable preventive
control. We continue to believe that annual written assurance from a
manufacturer/processor's direct customer is an appropriate mechanism to
ensure that its customer is aware of the identified hazard and is
taking steps to ensure that the food is processed to control the
identified hazard. We do not believe that a manufacturers/processor
will need all of the details of its customer's process to satisfy the
requirement to state in writing the procedures the customer has
established and is following to control the hazard. For example, the
customer could merely state that its manufacturing processes include a
lethality step for microbial pathogens of concern.
    We agree that it is appropriate to require that the manufacturer/
processor provide documentation to its customer indicating that the
food must be processed to control an identified hazard. Such
documentation will be a means of clear communication from the
manufacturer/processor to its customer. When the hazard will not be
controlled by the customer, the customer will still have documentation
that can be passed on to the entity that is expected to process the
food to control the identified hazard, so that it will be very clear to
that entity that the identified hazard still needs to be controlled.
    (Comment 446) Some comments ask us to delete the proposed
requirement to maintain the written assurance as a record.
    (Response 446) We decline this request. As already discussed in
this section, it is the combination of requirements (i.e., for
documentation that the food is ``not processed to control [identified
hazard]''; assurance from customers regarding appropriate procedures to
ensure that the food will receive further processing to control the
identified hazards; and provisions relating to accountability for
written assurances) that will provide adequate assurance that the food
will be processed to control the identified hazard before it reaches
consumers. Records documenting the written assurances are a key
component of the provisions.

XXVIII. Subpart C: Comments on Proposed Requirements for a Recall Plan
(Final Sec.  117.139)

    We proposed that you must establish a written recall plan for food
with a significant hazard and that the recall plan must include certain
procedures. Some comments support the proposed requirements without
change. For example, some comments express the view that a written
recall plan is critical in the event of a system breakdown where
adulterated foods have been distributed. Some comments that support the
proposed requirements note that many model plans are available to
industry. Other comments state that the proposed requirements for a
recall plan mirror guidelines in many fresh produce commodity-specific
food safety guidelines and seem appropriate for all types of facilities
handling fresh produce. Some comments that support the proposed
provisions suggest

alternative or additional regulatory text (see, e.g., Comment 447,
Comment 452, Comment 453, and Comment 454).
    In the following paragraphs, we discuss comments that ask us to
clarify the proposed requirements or that disagree with, or suggest one
or more changes to, the proposed requirements. After considering these
comments, we are finalizing the requirements as proposed with the
conforming revision to use the term ``hazard requiring a preventive
control'' rather than ``significant hazard.'' See Response 126 and
table 52. We also are redesignating the requirements as Sec.  117.139.
As discussed in section XXVII, we are establishing a provision applying
to certain assurances in Sec.  117.137.

A. Proposed Sec.  117.137(a)--Requirement for a Written Recall Plan
(Final Sec.  117.139(a))

    We proposed that you must establish a written recall plan for food
with a significant hazard.
    (Comment 447) Some comments ask us to require a written recall plan
for all food (rather than just for food with a significant hazard) and
to establish the requirements for a written recall plan as CGMP
requirements in subpart B rather than as part of the requirements for
hazard analysis and risk-based preventive controls in subpart C. These
comments assert that all products can be subject to a recall. These
comments contrast recall plans with other preventive controls in that
recall plans are often specific to a firm or facility, but rarely are
specific to particular foods. In addition, these comments note that a
recall may be administered and managed at the corporate office rather
than at the specific manufacturing facility that produced the food.
    Some comments note the requirements for a written recall plan are
sufficiently different from other provisions in subpart C that we
proposed to specify that the recall plan would not be subject to the
preventive control management requirements for monitoring, corrective
actions, and verification (see Sec.  117.140(c)). Some comments note
that facilities that are exempt from the requirements of subpart C, but
remain subject to the CGMP requirements, would not be required to have
a recall plan unless we establish the requirements in subpart B.
    Some comments note that our authority to require recall plans is
not limited to section 418 of the FD&C Act and that we can use other
legal authority to impose a requirement for recall plans in subpart B.
Some comments note that FSMA specifically amended the FD&C Act to
provide us with the authority to mandate a food recall (section 423 of
the FD&C Act). These comments assert that it would be reasonable for us
to conclude that in order to efficiently carry out section 423 of the
FD&C Act we should issue requirements governing the conduct of recalls,
because section 423 of the FD&C Act requires that we provide a firm
with an opportunity to voluntarily recall a product before issuing an
order to the firm to cease distribution and recall a product.
    (Response 447) We decline the request to establish requirements for
a written recall plan as a CGMP requirement in subpart B and are
establishing the requirements as a preventive control in subpart C as
proposed. We acknowledge that a recall plan would be useful to all food
establishments, and we encourage all food establishments to have a
recall plan. However, the report issued by the CGMP Modernization
Working Group did not identify the lack of a written recall plan as
something that needed to be changed (Ref. 3). (See 78 FR 3646 at 3651
for a discussion of the CGMP Modernization Working Group and the
process leading to its report.) However, going forward we intend to
monitor whether the lack of a broader requirement for a recall plan
leads to problems when food establishments that are not subject to the
requirements of subpart C are faced with recall situations. As we gain
experience with the impact of the new requirement for a recall plan on
those facilities subject to subpart C, we can reassess at a later date
whether to conduct rulemaking to broaden the requirement to apply to
all food establishments subject to the CGMP requirements in subpart B.
For now, food establishments that are not subject to subpart C can
continue to follow our long-standing recall policy in part 7.
    Consistent with the overall framework of FSMA, a recall plan (like
other preventive controls) is only required when the facility has
identified a hazard requiring a preventive control. A facility could
establish a recall plan that applies to other foods it manufactures. We
recognize that recalls may be managed by the corporate office of a firm
rather than at the specific manufacturing facility that produced the
food. Nothing in the rule precludes this approach. In such cases the
corporate recall policy would be reflected in a facility's recall plan.
(See also (Response 371.) In addition, a facility that identifies one
or more hazards requiring a preventive control in multiple food
products could use the same recall plan for all applicable food
products.
    The rule specifies that the requirements for preventive control
management components (i.e., monitoring, corrective actions and
corrections, and verification) apply as appropriate to ensure the
effectiveness of the preventive control, taking into account the nature
of the preventive control (Sec.  117.140(a)). As previously discussed,
the preventive control management components are directed at food that
remains at the facility, whereas the recall plan addresses food that
has left the facility (78 FR 3646 at 3745). Our determination that the
nature of the recall plan does not require these preventive control
management components demonstrates the flexibility provided by FSMA and
this rule, not that the recall plan must be considered a CGMP rather
than a preventive control.
    We have not yet made a determination of whether we should issue
requirements governing the conduct of recalls, rather than rely on the
guidelines in part 7, in order to fully implement section 423 of the
FD&C Act. However, we have issued draft guidance entitled ``Draft
Guidance for Industry: Questions and Answers Regarding Mandatory Food
Recalls'' which, when finalized, would address topics such as the
criteria for a mandatory recall and the process that FDA must follow
for a mandatory recall (Ref. 75).
    (Comment 448) Some comments assert that the requirements for a
recall plan should only apply to RTE food.
    (Response 448) These comments are suggesting that the rule
predetermine the outcome of the hazard analysis at all facilities. The
framework provided by FSMA and established in this rule makes it the
responsibility of each facility to appropriately determine the hazards
requiring a preventive control, and establish preventive controls as
appropriate to the facility and the food.
    (Comment 449) Some comments ask us to cross-reference the
provisions of part 7 (21 CFR part 7) rather than establish requirements
that these comments assert would be duplicative with the provisions of
part 7. These comments ask us to address any more substantive
requirements than are already in part 7 as part of a review of part 7.
These comments assert that part 117 should require a written recall
plan, but not require a ``written recall plan for the food,'' to be
consistent with the approach of part 7.
    (Response 449) We decline these requests. Part 7 addresses
enforcement policy, and the provisions for recalls in subpart C of part
7 are ``Guidance on Policy, Procedures, and Industry
Responsibilities.'' These recall

provisions do not establish requirements and are not binding on
industry. They also are broadly directed to recalls for all FDA-
regulated products, not just food. As already discussed (see Response
447), nothing in this rule would prevent a facility that establishes a
recall plan for a particular food from using that recall plan for any
food product that the facility decides to recall.

B. Proposed Sec.  117.137(b)--Procedures That Describe the Steps To Be
Taken, and Assign Responsibility for Taking Those Steps (117.139(b))

    We proposed that the recall plan must include procedures that
describe the steps to be taken, and assign responsibility for taking
those steps, to perform the following actions as appropriate to the
facility: (1) Directly notify the direct consignees of the food being
recalled, including how to return or dispose of the affected food; (2)
notify the public about any hazard presented by the food when
appropriate to protect the public health; (3) conduct effectiveness
checks to verify that the recall is carried out; and (4) appropriately
dispose of recalled food (e.g., through reprocessing, reworking,
diverting to a use that does not present a safety concern, or
destroying the food). We requested comment on whether: (1) The proposed
procedures are appropriate for all types of facilities; (2) we should
require a recall plan to include procedures and assignment of
responsibility for notifying FDA of recalls subject to the plan; and
(3) we should include a requirement for a mock recall as a verification
activity.
    (Comment 450) Some comments ask us to modify the proposed
requirements for a recall plan to clearly differentiate between
manufacturers and distributors. These comments note that distributors
are often not the initial recalling firm and ask us to clarify that the
manufacturer, rather than the distributor, is the responsible party for
notifying the public. Other comments ask us to modify and simplify the
details of the recall plan for smaller businesses based on product,
distribution, and other factors.
    (Response 450) In the 2014 supplemental human preventive controls
notice, we revised the proposed requirements for a recall plan by
specifying that the procedures in the recall plan are ``as appropriate
to the facility.'' As a result, the rule explicitly provides
flexibility for a recall plan to be different based on characteristics
such as size of the facility or the role of the facility in the food
supply chain. For example, the rule provides flexibility for a small
business to simply specify that it will telephone its customers.
Although we decline the request to specify that the manufacturer,
rather than the distributor, is the responsible party for notifying the
public, the rule provides flexibility for a distributor to establish,
through its business relationships with manufacturers, that this would
be the procedure established in the distributor's recall plan.
    (Comment 451) Some comments ask us to delete the proposed
requirement that the recall plan include procedures for a facility to
notify the public about any hazard presented by the food when
appropriate to protect public health. These comments assert that such a
requirement would be highly subjective and create a nebulous regulatory
burden that could subject facilities to unnecessary regulatory
oversight and enforcement actions.
    (Response 451) We decline this request. Our guidance for a recall
strategy has long recommended issuing a public warning to alert the
public that a product being recalled presents a serious hazard to
health in urgent situations where other means for preventing use of the
recalled product appear inadequate (Sec.  7.42(b)(2)). Operationally,
such notification to the public is so common that our current home page
on our Internet site (Ref. 76) gives prominence to recall information,
and we have established a free email subscription service for updates
on recalls (Ref. 77). Consistent with the long-standing recall policy
in part 7, subpart C, the proposed requirement qualifies that the
notification to the public is ``when appropriate to protect public
health.''
    (Comment 452) Some comments ask us to specify that food recall
plans include a minimum data requirement about the food product in
question. These comments assert that information such as lot, batch,
product size, and production date are critical in sorting defective
products from non[hyphen]defective ones.
    (Response 452) The procedures that must be established in a recall
plan are those that describe the steps that will be taken to notify
entities that a product must be removed from commerce, to verify that
product is removed, and to appropriately dispose of the product.
Information (such as lot, batch, product size, and production date) is
necessary to be able to carry out the steps that must be included in
the procedures and can be a useful component of the procedures that a
facility includes in its recall plan, because a facility would need to
obtain such information about the specific product being recalled when