A. 2013 Overall Framework for Hazard Analysis and Risk-Based Preventive
Controls

    In general, in the 2013 proposed preventive controls rule we
proposed that the owner, operator, or agent in charge of a facility:
    Prepare and implement a food safety plan, which would include
documentation such as a written hazard analysis and various written
procedures;
    Conduct a hazard analysis to identify and evaluate known or
reasonably foreseeable hazards to determine whether there are hazards
that are ``reasonably likely to occur'';
    Identify and implement preventive controls, including at CCPs, if
any, to provide assurances that hazards identified as ``reasonably
likely to occur'' will be significantly minimized or prevented;
    Establish a written recall plan for food with a hazard identified
as ``reasonably likely to occur'';
    Monitor the preventive controls with adequate frequency to provide
assurance that they are consistently performed;
    Establish and implement written corrective action procedures that
must be taken if preventive controls are not properly implemented;
    Take appropriate corrective action in the event of an unanticipated
problem if a preventive control is not properly implemented and a
specific corrective action procedure has not been established;
    Conduct certain verification activities; and
    Establish and maintain certain records.
    These proposed provisions applied a construct we previously used in
our Hazard Analysis and Critical Control Point (HACCP) regulations for
seafood (21 CFR part 123) and juice (21 CFR part 120)--i.e., whether a
known or reasonably foreseeable hazard was ``reasonably likely to
occur.'' In general, our HACCP regulations for seafood and juice focus
on CCPs to control hazards that are ``reasonably likely to occur.''

B. Comments on the ``Reasonably Likely To Occur'' Construct Within the
2013 Overall Framework for Hazard Analysis and Risk-Based Preventive
Controls

    Some stakeholders expressed concern, during outreach activities
such as the public meetings and in written comments, about including
the ``reasonably likely to occur'' approach in the 2013 proposed
preventive controls rule. Some comments express concern that using the
phrase ``reasonably likely to occur'' in two different contexts (i.e.,
within our HACCP regulations as well as in our proposed preventive
controls regulations) would be confusing. Some comments assert that the
``reasonably likely to occur'' approach was already so closely linked
to our HACCP regulations that the 2013 proposed preventive controls
rule would be interpreted as requiring that all necessary preventive
controls be established at CCPs. These comments note that such an
interpretation would be inconsistent with FSMA. For example, FSMA
requires that the owner, operator, or agent in charge of a facility
identify and implement preventive controls, including at critical
control points, if any (emphasis added) (section 418(c) of the FD&C
Act). In addition, the definition of ``preventive controls'' in FSMA is
broader than CCPs (section 418(o)(3) of the FD&C Act). The comments ask
that we more explicitly provide for implementation of a range of
preventive controls (not just at CCPs.) These comments also express
concern that a facility that already had established controls to
address hazards--but not at CCPs--would need to revise its food safety
plan and re-create any applicable records (e.g., various written
procedures) to satisfy the recordkeeping requirements of the rule,
which would add costs but no food safety benefits. Some comments
suggest that the framework be clearer that the requirements for
preventive controls apply to hazards that are of such a nature that
control measures to significantly minimize or prevent them are
necessary for the production of a safe food and therefore must be
addressed in the food safety plan.
    Other comments on the overall framework for hazard analysis and
risk-based preventive controls express concern that the regulatory
text, as proposed, would limit a facility's flexibility to develop and
implement a food safety system that was indeed risk-based. For example,
some comments assert that regulatory text such as ``[p]reventive
controls must include, as appropriate to the facility and the food''
appears to provide flexibility, but the practical effect of the term
``must'' preceding the phrase ``include, as appropriate to the facility
and the food'' is to remove any flexibility as to what preventive
controls must be established and implemented. As another example, these
comments emphasize that the proposed requirements did not sufficiently
emphasize the risk-based nature of each component of the overall
framework for hazard analysis and preventive controls, including
monitoring, corrective action procedures, and verification activities,
in addition to the hazard analysis and preventive controls. In general,
these comments recommend that we provide greater flexibility to manage
the control of hazards based on an assessment of both the severity of
the hazard and the probability that the hazard will occur in the
absence of preventive controls and that we recognize the role of
prerequisite programs in the management of hazards. (One definition of
``prerequisite program'' is the ``procedures, including good
manufacturing practices, that address operational conditions providing
the foundation for the HACCP system'' (Ref. 17).)

C. Proposed Revisions to the Overall Framework for Hazard Analysis and
Risk-Based Preventive Controls

    The 2013 proposed preventive controls rule would not have required
that all preventive controls be established at CCPs. However, we
acknowledge that it could be confusing to use the same phrase
``reasonably likely to occur'' in both our HACCP regulations and in the
regulations we are proposing to establish to implement FSMA's
requirements for hazard analysis and risk-based preventive controls,
because the phrase ``reasonably likely to occur'' has been used as the
basis for determining hazards that need to be addressed in a HACCP plan
at CCPs.
    Likewise, the 2013 proposed preventive controls rule would not have
limited a facility's flexibility to develop and implement a food safety
system that was indeed risk-based. However, we acknowledge that some
specific changes to the proposed regulatory text could help to clarify
the risk-based nature of all provisions of subpart C.

    We have not used the term ``prerequisite program'' in the proposed
regulatory text because, like ``hazard reasonably likely to occur,'' it
has a connotation with respect to our seafood and juice HACCP programs,
that is, it connotes activities that a facility may do that have an
impact on product safety but which are outside the scope of the
regulatory program. However, comments are not suggesting that
prerequisite programs that are essential to ensuring food safety should
be outside the scope of this proposed regulatory scheme. In fact,
comments asking that we recognize the role of prerequisite programs in
the management of hazards point out that preventive controls include
control measures that do not include CCPs and that companies would
consider many of these to be prerequisite programs. We acknowledge that
oftentimes preventive controls, other than those at critical control
points, are important parts of a food safety system, and must therefore
be included in the food safety plan that would be required by this
proposed rule. We attempted to make that clear in the proposed
requirement for preventive controls in Sec.  117.135(a) by
incorporating reference to ``controls, other than those at critical
control points, that are necessary for food safety.''
    We did not intend to require that a facility re-create or duplicate
existing records associated with controls; we simply laid out in the
2013 proposed preventive controls rule the activities for which we
expect there to be records and the information we expect to find in
those records.
    Taking into account the comments we have reviewed so far, we are
proposing a series of revisions to proposed subpart C and are reopening
the comment period specifically with respect to these proposed
revisions. These proposed revisions include:
    Eliminating the term ``hazard reasonably likely to occur''
throughout proposed subpart C (and, thus, deleting the definition we
had proposed for this term).
    Adding a new defined term, ``significant hazard,'' and, in general,
using this new term instead of ``hazard reasonably likely to occur''
throughout the proposed regulations. ``Significant hazard'' would mean
a known or reasonably foreseeable hazard for which a person
knowledgeable about the safe manufacturing, processing, packing, or
holding of food would, based on the outcome of a hazard analysis,
establish controls to significantly minimize or prevent the hazard in a
food and components to manage those controls (such as monitoring,
corrections or corrective actions, verification, and records) as
appropriate to the food, the facility, and the nature of the control.
    Defining ``known or reasonably foreseeable hazard'' in place of
``reasonably foreseeable hazard'' and clarifying that the new term
means a hazard ``that has the potential to be associated with the
facility or the food'' rather than ``a potential . . . hazard that may
be associated with the facility or the food'';
    Providing additional flexibility to address concerns about re-
writing existing plans or programs to conform with the requirement of
the preventive controls rule by explicitly providing that:
    Preventive controls include controls, other than those at critical
control points, that knowledgeable persons commonly recognize as
appropriate for food safety;
    The preventive control management components (i.e., monitoring,
corrective actions, and verification) depend on the nature of the
control; and
    The recordkeeping requirements do not require duplication of
existing records if those records contain all of the required
information and satisfy the recordkeeping requirements of the
regulation. Existing records may be supplemented as necessary to
include all of the required information. In addition, the required
information does not need to be kept in one set of records. If existing
records contain some of the required information, any new information
required by the preventive controls rule may be kept either separately
or combined with the existing records.
    The framework provided by ``significant hazard'' would reflect a
two-part analysis on the part of a facility. First, the facility would
narrow ``hazards'' to those hazards that are known or reasonably
foreseeable--i.e., those biological, chemical (including radiological),
or physical hazards that have the potential to be associated with the
facility or the food. Second, the facility would narrow the known or
reasonably foreseeable hazards to those that a person knowledgeable
about the safe manufacturing, processing, packing, or holding of food
would, based on the outcome of a hazard analysis, establish controls to
significantly minimize or prevent the hazard in a food as well as
components to manage those controls (such as monitoring, corrections or
corrective actions, verification, and records) as appropriate to the
food, the facility, and the nature of the control.
    The framework established by ``significant hazard'' also would
incorporate the concept of risk by specifying that ``significant
hazards'' are based on the outcome of a hazard analysis. The hazard
analysis would require an evaluation of known or reasonably foreseeable
hazards to assess two key aspects of risk--i.e., the severity of the
illness or injury if the hazard were to occur and the probability that
the hazard will occur in the absence of preventive controls.
    See the revised regulatory text for the proposed new definition of
``significant hazard'' (proposed Sec.  117.3). The term ``significant
hazard'' has sometimes been used in the context of HACCP to refer to
the hazards to be addressed in a HACCP plan through CCPs. However, this
term is not used in the seafood, juice or meat and poultry HACCP
regulations, which focus on ``hazards reasonably likely to occur.'' We
request comment on both the proposed name of the term and the proposed
meaning of the term. See also the proposed new provision for the use of
existing records (proposed Sec.  117.330, which would be established in
subpart F). Table 6 provides some examples of the flexibility that a
facility would have in complying with the revised requirements that
would be established in subpart C.

Table 6--Examples of Flexibility for Complying With the Requirements for
    Hazard Analysis and Risk-Based Preventive Controls in the Revised
                   Requirements in Proposed Subpart C
------------------------------------------------------------------------
      Flexibility related to . . .                   Example
------------------------------------------------------------------------
Controls other than those at CCPs......  Dividing a facility into zones
                                          based on the risk with respect
                                          to contamination of product
                                          can be a preventive control,
                                          but would not be required to
                                          have a CCP.
Controls other than those at CCPs......  Preventive maintenance that
                                          inspects and changes chopper
                                          blades on a regular intervals
                                          may be considered a preventive
                                          control in some instances but
                                          would not be required to have
                                          a CCP.

Circumstances that do not require        Preventive controls for
 process controls.                        allergen cross-contact.
Circumstances that do not require        Supplier controls.
 process controls.
Monitoring activity that generally       Monitoring for foreign material
 would not require monitoring records.    with x-rays.
Corrections that generally would not     Re-cleaning and sanitizing
 require records.                         inadequately cleaned food
                                          contact surfaces before start
                                          up.
Preventive controls that would not       Zoning controls.
 require validation.
Preventive controls that would not       Segregation of allergens during
 require validation.                      storage.
Preventive controls that would not       Training.
 require validation.
Preventive controls that would not       Preventive maintenance.
 require validation.
Preventive controls that would not       Refrigerated storage.
 require validation.
Corrective action that generally would   Replacement of equipment.
 not require verification.
------------------------------------------------------------------------

X. Potential Requirements for Product Testing and Environmental
Monitoring

A. Our Request for Comment on Including Requirements for Product
Testing and Environmental Monitoring in a Final Rule

    In the 2013 proposed preventive controls rule, we described the
statutory framework of FSMA for product testing and environmental
monitoring as verification measures. We also requested comment on when
and how product testing programs and environmental monitoring are an
appropriate means of implementing section 418 of the FD&C Act (78 FR
3646 at 3762-3765). We specifically requested comment on including
requirements for product testing programs and environmental monitoring
in a final rule. Although we did not propose specific regulatory text,
we asked a series of questions about what such requirements should
include. Our discussions and questions about ``product testing''
focused on ``finished product testing.'' The Appendix contained
extensive background on the role of testing as a verification measure
in a modern food safety system (78 FR 3646 at 3812-3820; see also the
corrected Appendix, 78 FR 17142 at 17143 to 17151).

B. Product Testing

1. Comments on Product Testing
    Some comments support product testing as a verification activity
and make recommendations for what should be tested, how testing could
be tied to risk, and how product testing could be used in a food safety
plan. Some of these comments emphasize that product testing would not
be appropriate as a control measure. Other comments do not support
including requirements for ``finished product testing'' as a
verification measure, but support including requirements for ``product
testing'' in the final rule if the focus is broader than ``finished
product testing,'' the use of product testing is tied to risk, and the
regulations provide flexibility in how product testing is used in a
food safety plan. Some comments assert that product testing is required
by section 418 of the FD&C Act and that it is an appropriate means of
verifying overall control, especially for products that support
pathogen growth. In the following paragraphs, we describe some of the
key recommendations in the comments regarding what should be tested,
how testing could be tied to risk, and how product testing could be
used in a food safety plan.
    Some comments recommend that product testing include testing raw
materials and ingredients, as well as in-line testing of product during
production. Some comments recommend that requirements encompassing more
than ``finished product testing'' would provide facilities with the
flexibility to establish a risk-based testing program. For example, a
facility that adds seasoning to chips after the chips have been cooked
using a process that would significantly minimize pathogens may
conclude that testing the seasoning used as an ingredient would be a
more appropriate verification activity than testing finished product
(i.e., the chips with the added seasoning). These comments also assert
that requirements for ``product testing'' would be more consistent with
the statutory direction in section 418 of the FD&C Act than
requirements for ``finished product testing.''
    Some comments that emphasize the risk-based nature of any
requirements for product testing assert that product testing may be of
limited value for a product that will undergo a ``kill step'' (a
treatment to significantly minimize pathogens) later in processing or
that does not support the survival or growth of environmental pathogens
(because such organisms are unlikely to pose a risk in the finished
food). Other comments note that product testing would not be
appropriate for certain types of facilities, such as distributors. Some
comments question whether product testing would be appropriate for
products with a short shelf life (such as produce).
    Some comments identify circumstances where product testing would--
or would not--be appropriate to include as a verification activity in a
food safety plan. For example, comments state that product testing
would be an appropriate verification activity to include in a food
safety plan in plants that produce high-risk products; when there is a
risk of contamination of the product or product contact surfaces; when
the outcome of a hazard analysis demonstrates that a hazard can remain
or be placed on ready-to-eat (RTE) products; when an environmental
pathogen is considered a hazard reasonably likely to occur; when a
positive result is obtained as a result of environmental monitoring;
after a corrective action has been implemented (such as after a product
has been reworked because it tested positive for a pathogen); and in
circumstances where testing is the only practical way to verify the
absence of a contaminant (such as aflatoxin). Some comments state that
product testing would not be an appropriate verification activity to
include in a food safety plan if a positive result from environmental
monitoring is found on a non-product-contact surface.
    Some comments recommend written procedures for product testing.
Some of these comments emphasize that any requirements for such written
procedures should not be prescriptive.
    Some comments question whether it would be appropriate to require
product testing in light of known limitations such as those discussed
in section I.F of the Appendix. For example, it is generally recognized
that testing cannot

ensure the absence of a hazard, particularly when the hazard is present
at very low levels and is not uniformly distributed. Moreover, these
comments point out that the number of samples used for routine testing
often is statistically inadequate to provide confidence in the safety
of an individual lot in the absence of additional information about
adherence to validated control measures (78 FR 3646 at 3819). Some
commenters with varying views on the issue nonetheless asked FDA to
issue proposed regulatory text for product testing for consideration.
2. Potential Requirements for Product Testing
    We acknowledge that there are limitations to product testing.
Nonetheless, product testing programs, when implemented appropriately
based on the facility, the food, and the nature of the preventive
control, could be used to verify that the preventive controls are
effectively and significantly minimizing or preventing the occurrence
of identified hazards. Taking into account the comments we have
reviewed so far, we are providing an opportunity for public comment on
potential requirements for product testing. Such requirements would be
tied to risk and addressed through flexible written procedures that
would address both test procedures and corrective action plans.
    In this section of this document, we are reopening the comment
period with respect to our previous request for comment on when and how
product testing programs are an appropriate means of implementing FSMA.
We are seeking comment on whether requirements for product testing
should be included in a final rule and, if so, what (if any)
modifications to the proposed regulatory text would be appropriate. The
proposed regulatory text would, if included in a final rule, establish
requirements for:
    Product testing as an activity for verification of implementation
and effectiveness as appropriate to the facility, the food, and the
nature of the preventive control (proposed Sec.  117.165(a)(2));
    Written procedures for product testing (proposed Sec.
117.165(b)(2));
    Corrective action procedures for product testing (proposed Sec.
117.150(a)(1)(ii)(A)); and
    Records of product testing (proposed Sec.  117.155(b));
    See the proposed regulatory text for proposed subpart C for the
full text of such potential requirements. Consistent with the requests
of the comments, the proposed regulatory text would provide flexibility
for a facility to make risk-based decisions on when product testing
would be appropriate by providing that the facility can take into
account the facility, the food, and the nature of the preventive
control (e.g., whether the control is a kill step) rather than
prescribe product testing in specific circumstance, or require that all
types of facilities (including warehouses) conduct product testing. For
supplementary information relevant to product testing, see the 2013
proposed preventive controls rule (78 FR 3646 at 3763-3764), the
corrected Appendix (78 FR 17142 at 17143 to 17151), and Ref. 18.

C. Environmental Monitoring

1. Comments on Environmental Monitoring
    Some comments support environmental monitoring as a verification
activity. In general, these comments recommend that the final rule
specifically require environmental monitoring when RTE product is
exposed to the environment prior to packaging and the packaged food
does not receive a treatment that would significantly minimize an
environmental pathogen that could contaminate the food when it is
exposed. Comments emphasize the need for flexible requirements that
would allow facilities to tailor their programs based on risk.
    Some comments that generally support environmental monitoring as a
verification activity nonetheless express concern about the potential
for such requirements to be overly prescriptive. Comments particularly
express concern about potentially prescriptive requirements for
corrective actions if an environmental pathogen or appropriate
indicator organism is detected. Some comments express concern about how
potentially prescriptive requirements would impact products (such as
produce) with a short shelf life.
    Some comments do not support including requirements for
environmental monitoring as a verification measure. Some of these
comments assert that requirements for environmental monitoring would
not be in accord with guidelines issued by the Codex Alimentarius
Commission (Codex). Some comments note that environmental monitoring
would not be relevant to all products, such as products that will be
heat-treated or otherwise subject to a kill-step. Other comments note
that environmental monitoring would not be relevant to facilities such
as food distributors, due to the low likelihood of product
contamination occurring in storage and distribution centers. Some of
these comments express concern about broad requirements that would
require environmental monitoring in a manner that was not risk-based,
such as when an environmental pathogen is not reasonably likely to
occur. Some commenters with varying views on the issue nonetheless
asked FDA to issue proposed regulatory text for environmental
monitoring for consideration.
2. Potential Requirements for Environmental Monitoring
    Although the HACCP Annex of the Codex General Principles of Food
Hygiene (Ref. 19) does not specifically recommend environmental
monitoring as a verification activity in HACCP systems, the Codex
General Principles of Food Hygiene (Ref. 20) does indicate that
sanitation systems should be monitored for effectiveness and
periodically verified, where appropriate, by microbiological sampling
of environment and food contact surfaces, and regularly reviewed and
adapted to reflect changed circumstances. Environmental monitoring is
recommended in Codex Guidelines on the Application of General
Principles of Food Hygiene to the Control of Listeria monocytogenes in
Foods (see Annex I) (Ref. 21) and the Code of Hygienic Practice for
Powdered Formulae for Infants and Young Children (see Annex III) (Ref.
22). Moreover, currently available data and information support the
role of environmental monitoring in a food safety system that
incorporates hazard analysis and risk-based preventive controls. (See,
e.g., the 2013 proposed preventive controls rule (78 FR 3646 at 3764-
3765), the corrected Appendix (78 FR 17142 at 17143 to 17151), and
(Ref. 23). Environmental monitoring programs, when implemented
appropriately based on the facility, the food, and the nature of the
preventive control, could be used to verify that the preventive
controls are effectively and significantly minimizing or preventing the
occurrence of identified hazards.
    Taking into account the comments we have reviewed so far, we are
providing an opportunity for public comment on potential requirements
for environmental monitoring. The potential requirements would provide
flexibility for facilities to tailor their environmental monitoring
programs based on risk. Environmental monitoring would be required in
the specific circumstances where RTE product is exposed to the
environment prior to packaging and the packaged

food does not receive a treatment that would significantly minimize an
environmental pathogen that could contaminate the food when it is
exposed. However, the potential requirements would not otherwise
specify circumstances where environmental monitoring would be required
and would instead require that the facility conduct environmental
monitoring as appropriate to the facility, the food, and the nature of
the preventive control. The potential requirements would also not be
prescriptive in the types of corrective actions needed in response to
detecting an environmental pathogen or appropriate indicator organism
in the environment; they would provide flexibility for facilities to
establish and implement written corrective action procedures to
identify and correct the problem, reduce the likelihood that the
problem will recur, evaluate all affected food for safety, and, as
necessary, prevent affected food from entering commerce.
    In this section of this document, we are reopening the comment
period with respect to our previous request for comment on when and how
environmental monitoring is an appropriate means of implementing FSMA.
We are seeking comment on whether requirements for environmental
monitoring should be included in a final rule and, if so, what (if any)
modifications to the proposed regulatory text would be appropriate. The
proposed regulatory text would, if included in a final rule, establish
requirements for:
    Performing, as part of the hazard evaluation, an evaluation of
environmental pathogens whenever an RTE food is exposed to the
environment prior to packaging and the packaged food does not receive a
treatment that would significantly minimize the pathogen (proposed
Sec.  117.130(c)(1)(ii));
    Environmental monitoring, for an environmental pathogen (e.g., L.
monocytogenes) or for an appropriate indicator organism (e.g., Listeria
spp.), as an activity for verification of implementation and
effectiveness as appropriate to the facility, the food, and the nature
of the preventive control, if contamination of an RTE food with an
environmental pathogen is a significant hazard (proposed Sec.
117.165(a)(3));
    Records of environmental monitoring (proposed Sec.  117.155(b));
    Written procedures for environmental monitoring (proposed Sec.
117.165(b)(3)); and
    Corrective action procedures for environmental monitoring (proposed
Sec.  117.150(a)(1)(ii)(B)).
    See the proposed regulatory text for proposed subpart C for the
full text of such potential requirements. For supplementary information
relevant to environmental monitoring programs, see the 2013 proposed
preventive controls rule (78 FR 3646 at 3764-3765), the corrected
Appendix (78 FR 17142 at 17143 to 17151), and Ref. 23.

XI. Potential Requirements for a Supplier Program

A. Our Request for Comment on When and How Supplier Verification
Activities Are an Appropriate Means of Implementing the Statutory
Framework of Section 418 of the FD&C Act

    In the 2013 proposed preventive controls rule, we described the
statutory framework of FSMA for supplier controls--i.e., the supplier
verification activities that section 418 of the FD&C Act includes as an
example of preventive controls. We also requested comment on when and
how supplier verification activities are an appropriate means of
implementing section 418 (78 FR 3646 at 3763-3767). We specifically
requested comment on including requirements for supplier approval and
other verification activities in a final rule. Although we did not
propose specific regulatory text, we asked a series of questions about
what such requirements should include. The Appendix contained extensive
background on the role of supplier programs in a modern food safety
system (78 FR 3646 at 3820-3821; see also the corrected Appendix, 78 FR
17142 at 17151 to 17152).

B. Comments on When and How Supplier Verification Activities Are an
Appropriate Means of Implementing the Statutory Framework of Section
418 of the FD&C Act

    Some comments support including requirements for a supplier program
in a final rule. These comments emphasize the need for flexible
requirements that would allow facilities to tailor their programs based
on risk, including risk inherent to raw materials and ingredients and
risk that may be associated with a particular supplier (e.g., as
reflected by the supplier's performance history). These comments
provide many specific recommendations for what such requirements
should--and should not--include. We summarize these recommendations in
Table 7.

  Table 7--Summary of Specific Recommendations in Comments That Support
                   Requirements for a Supplier Program
------------------------------------------------------------------------
                                          Most comments do not support a
  Most comments support a requirement:             requirement:
------------------------------------------------------------------------
For receiving raw material and           For a written list of approved
 ingredients from approved suppliers.     suppliers (because the list
                                          would be subject to frequent
                                          (perhaps daily) change).
For verification of a facility's         For verification of the
 immediate supplier.                      supplier's supplier (because
                                          the facility has the greatest
                                          knowledge, leverage and
                                          ability to conduct meaningful
                                          oversight of its immediate
                                          supplier and because it is the
                                          supplier who is accountable to
                                          verify back one more step).
For records documenting that the basic   For documents such as an
 requirements are being carried out.      underlying audit report
                                          (because of concerns about
                                          confidential information).
For audits as a verification activity,   Prescribing the frequency of
 provided that the requirements are       audits (particularly an annual
 flexible and audits are not over-        frequency) (because an audit
 emphasized at the expense of other       is only one tool and audits
 verification activities.                 should be based on risk and on
                                          the performance of the
                                          supplier).
Limiting a supplier program to           Specifying that some hazards
 facilities that manufacture or process   require more than one
 food.                                    verification activity (because
                                          doing so would be too
                                          prescriptive and would not
                                          allow the facility the
                                          flexibility to determine the
                                          appropriate risk-based
                                          approach).
For oversight of a supplier program by   For a receiving facility to
 a qualified individual.                  identify the regulations to
                                          which the supplier is subject
                                          (because the distinction would
                                          not be material to food
                                          safety).
That would be consistent with the        ...............................
 Foreign Supplier Verification Program
 being established in a separate
 rulemaking

Specifying that a supplier program may   ...............................
 be managed at a corporate level
 (rather than by specific facilities),
 because supplier programs are often
 managed at the corporate level. Some
 comments specifically recommend that
 inspection of a supplier program take
 place at the location where the
 program is managed, including at a
 corporate location rather than at an
 individual facility.
------------------------------------------------------------------------

    Comments also address several other issues, such as whether the
final rule should:
    Be limited to circumstances where a hazard is controlled by the
supplier, or be required even if the hazard would be controlled by the
receiving facility or by the receiving facility's customer.
    Include requirements for specific types of verification activities
based only on the seriousness of hazards. Although some comments
support such requirements, other comments do not because the basis
should be risk (which includes probability as well as severity).
    Allow substitution of an inspection (e.g., by FDA) for an audit.
Although some comments support such a substitution, others do not
because they assert that an inspection and an audit are different in
nature.
    Require a receiving facility to consider relevant regulatory
information about the supplier. Although some comments support such
requirements, others do not (e.g., because the information (which can
be part of an overall supplier assessment) may not be available in a
timely manner, is narrow in scope, and would diminish the importance of
the supplier's food safety plan and the effectiveness of its
implementation).
    Include requirements related to supplier non-conformance. Although
some comments support such requirements, others maintain that supplier
non-conformance would be better suited to guidance. Some comments
specifically oppose a requirement for ``discontinuing use of the
supplier'' and recommend flexibility for how a receiving facility would
address supplier non-conformance.
    Provide for alternative verification requirements when a supplier
is a qualified facility (which is subject to modified requirements; see
proposed Sec.  117.201 in the 2013 proposed preventive controls rule).
Although some comments support alternative requirements for suppliers
that are qualified facilities, others express concern about whether
alternative requirements can be practically implemented. Some comments
state that the supplier verification requirements should not prevent
facilities from sourcing ingredients from suppliers that are qualified
facilities.
    In general, comments that simply oppose including a supplier
program in the final rule express concern about cost, ingredient
diversity, and duplication of efforts. Some of these comments recommend
that we issue guidance on supplier verification activities rather than
establish requirements in the final rule. Some commenters, including
those with varying views about the issue, nonetheless requested that
FDA propose regulatory language for consideration.

C. Potential Requirements for a Supplier Program

    Section 418 of the FD&C Act specifically identifies supplier
verification activities as a preventive control (see section 418(o)(3)
of the FD&C Act), Supplier controls, when implemented appropriately,
are an important preventive control that can ensure that significant
hazards will be significantly minimized or prevented for those raw
materials and ingredients for which the receiving facility has
identified a significant hazard when the hazard is controlled before
receipt of the raw material or ingredient. Taking into account the
comments we have reviewed so far, we are providing an opportunity for
public comment on potential requirements for a supplier program as a
preventive control. In this section of this document, we are reopening
the comment period with respect to our previous request for comment on
when and how supplier programs are an appropriate means of implementing
FSMA. We are seeking comment on whether requirements for a supplier
program should be included in a final rule and, if so, what (if any)
modifications to the proposed regulatory text would be appropriate.
Elsewhere in this issue of the Federal Register, we are issuing a
supplemental notice of proposed rulemaking to amend the 2013 proposed
FSVP rule. In that supplemental notice we request comment, in light of
the statutory provisions, on the manner and extent to which the FSVP
and preventive controls supplier verification provisions--as well as
other aspects of the FSVP and preventive controls regulations--should
be aligned in the final rules.
    See the proposed regulatory text (proposed Sec.  117.136 and the
applicable definitions in proposed Sec.  117.3) for the full text of
such potential requirements. Briefly, the proposed regulatory text
would, if included in a final rule:
    Establish definitions for terms used in the potential requirements
for a supplier program (i.e., receiving facility; supplier; and
qualified auditor) (proposed Sec.  117.3)
    Establish a risk-based requirement for a written supplier program
that:
    Would require, with some exceptions, a supplier program for raw
materials and ingredients for which the receiving facility has
identified a significant hazard when the hazard is controlled before
receipt of raw material or ingredient (proposed Sec.  117.136(a)(1) and
(2); and
    Would not apply to raw materials and ingredients for which there
are no significant hazards, the preventive controls at the receiving
facility are adequate, or the receiving facility relies on the customer
and obtains written assurance (proposed Sec.  117.136(a)(1)(ii));
    Require verification activities, as appropriate to the hazard, and
documentation of such activities, to ensure raw materials and
ingredients are received only from suppliers approved for control of
the hazard(s) in that raw material or ingredient (or, when necessary
and appropriate, on a temporary basis from unapproved suppliers whose
raw materials or ingredients the receiving facility subjects to
adequate verification activities before acceptance for use) (proposed
Sec.  117.136(a)(3)(i));
    Require verification activities to verify that the hazard is
significantly minimized or prevented, the incoming raw material or
ingredient is not adulterated under section 402 of the FD&C Act or
misbranded under section 403(w) of the FD&C Act, and the incoming raw
material or ingredient is

produced in compliance with the requirements of applicable FDA food
safety regulations (proposed Sec.  117.136(a)(3)(ii));
    Provide flexibility for a receiving facility to determine and
document the appropriate verification activities for raw materials and
ingredients from particular suppliers, based on a series of factors,
except when there is a reasonable probability that exposure to a
significant hazard will result in serious adverse health consequences
or death to humans (proposed Sec. Sec.  117.136(b) and 117.136(c)(1))
(see next bullet);
    Require an annual audit as a verification activity when there is a
reasonable probability that exposure to the hazard will result in
serious adverse health consequences or death to humans, unless the
receiving facility documents its determination that other verification
activities and/or less frequent onsite auditing of the supplier provide
adequate assurance that the hazards are controlled (proposed Sec.
117.136(c)(2));
    Provide for an alternative verification activity when the supplier
is a qualified facility (proposed Sec.  117.136(c)(3));
    Provide for alternative verification activities when the supplier
is a farm that would not be subject to the requirements in the final
produce safety rule under proposed Sec.  112.4 (proposed Sec.
117.136(c)(4));
    Require that an audit be conducted by a qualified individual who
has technical expertise obtained by a combination of training and
experience appropriate to perform the auditing function (proposed Sec.
117.136(d)(1)) and proposed Sec.  117.180);
    Provide that inspection by FDA or an officially recognized or
equivalent food safety authority may substitute for an audit (proposed
Sec.  117.136(e));
    Require action to address supplier non-conformance (proposed Sec.
117.136(f)); and
    Require documentation of verification activities in records (listed
in proposed Sec.  117.136(g)), including minimum requirements for
records documenting an audit, records of sampling and testing, and
records documenting a review by the receiving facility of the
supplier's relevant food safety records (proposed Sec.  117.136(g)(5),
(6), and (7), respectively).
    In addition, the potential addition of requirements for a supplier
program would require conforming amendments to other provisions of the
rule, including the requirements for a food safety plan, preventive
controls, validation, verification of implementation and effectiveness,
and the list of implementation records for subpart C (see proposed
Sec. Sec.  117.126(b)(3), 117.135(c)(4), 117.140(b), 117.160(b)(3),
117.165(a)(4), and 117.190(a)(4), respectively). For supplementary
information relevant to a supplier program, see the 2013 proposed
preventive controls rule (78 FR 3646 at 3765-3767), the corrected
Appendix (78 FR 17142 at 17151- 17152), and Ref. 24. In the following
paragraphs, we provide additional information about the potential
proposed requirements for a supplier program.
    Reflecting the risk-based (including severity as well as
probability) nature of a supplier program, a receiving facility's
program would be limited to those raw materials and ingredients for
which the receiving facility has identified a significant hazard. As
discussed in section IX.C, ``significant hazard'' would be defined in
the rule. Under the definition, hazards are determined to be
significant based on the outcome of a hazard analysis and, thus the
determination would incorporate the concept of risk. In addition, a
receiving facility would establish and implement a supplier program
only when a significant hazard is controlled before receipt; a
receiving facility would not be required to establish and implement a
supplier program if the receiving facility, or the receiving facility's
customer, controls the hazard (and the customer provides assurances as
to the control). Under this risk-based approach, a processor of fresh-
cut produce generally would be required to establish a supplier program
for hazards associated with the fresh produce it processes (which would
be controlled by the supplier during growing and harvesting), but a
manufacturer of an acidified food would not be required to establish a
supplier program for peppers that it uses to produce salsa if it will
control any significant hazard for the peppers during manufacture of
the salsa.
    The potential supplier program would include requirements
applicable to a ``receiving facility'' and the proposed definition of
``receiving facility'' would describe a receiving facility as a
facility that manufactures/processes a raw material or ingredient that
it receives from a supplier. A supplier would be defined as the
establishment that manufactures/processes the food, raises the animal,
or harvests the food that is provided to a receiving facility without
further manufacturing/processing by another establishment, except for
further manufacturing/processing that consist solely of the addition of
labeling or similar activity of a de minimis nature. The supplier could
be an ``establishment'' rather than a ``facility'' because a supplier
may be an entity that is not required to register under section 415 of
the act and, thus, would not be a ``facility'' as that term would be
defined for the purpose of this rule. Under this definition, a facility
that packs or holds the food without any type of manufacturing/
processing would not be a supplier. Under this approach, a facility
would not be required to establish a supplier program for food products
that it only packs or distributes. For example, a receiving facility
might receive a raw material or ingredient from a distribution center
that receives the raw material or ingredient from a manufacturing
facility or a farm. The distribution center, which is the immediate
previous source of the raw material or ingredient, would not be
required to establish a supplier program and would not be considered
the supplier; rather the supplier would be the manufacturer or the farm
(which manufactured/processed the food or harvested the food that was
provided to the distribution center and subsequently to the receiving
facility). In such instance, if the receiving facility has identified a
significant hazard for the raw material or ingredient, and that hazard
is controlled by the supplier (the manufacturer or the farm), the
receiving facility would establish verification activities related to
the manufacturer or the farm that provided the raw material or
ingredient to the distribution center.
    If a facility receives an ingredient from a supplier, but the
control of the hazard is by the supplier's supplier, the receiving
facility would conduct supplier verification activities that would
include verifying that the supplier has conducted appropriate
verification that its supplier has controlled the hazard, i.e., the
receiving facility would review the supplier's food safety records for
its supplier's control of the hazard. For example, if a salad
manufacturer is receiving cut produce such as celery from a fresh-cut
produce supplier that receives celery from a farm, the salad
manufacturer could conduct verification activities related to the on-
farm controls by reviewing the supplier program of, and verification
activities conducted by, the fresh-cut produce supplier for its
supplier, the farm (in addition to verifying the fresh-cut produce
supplier's control of pathogens).
    We understand that, particularly for RACs, there may be multiple
establishments, including cooperatives, packing houses, and
distributers, between a receiving facility and the establishment that
would be considered the supplier, which would make

supplier verification very challenging under certain circumstances.
However, we believe that supplier verification is very important for
RACs, in particular produce that will be further processed or consumed
without a treatment that will significantly minimize or prevent
pathogens. We request comment on what verification activities would be
appropriate for receiving facilities to conduct when a raw material or
ingredient passes through more than one facility that would not be
required to verify control of hazards if supplier programs are limited
to manufacturers/processors. For example if a receiving facility is a
fresh-cut processing facility that receives produce from a distributor,
who receives produce from a cooperative, and neither the distributor
nor the cooperative is required to establish supplier controls for the
farms where the hazards are being controlled, what supplier controls
should be applied for the produce coming from the farms? We request
comment on whether and how the requirements for supplier verification
should address such situations.
    In addition, we seek comment regarding whether (and, if so, how)
the final preventive controls rule should address the potential for
gaps in supplier controls when a hazard is controlled at Point A in the
supply chain (e.g., by Supplier A, a farm), and Point B in the supply
chain is a facility (such as Warehouse B, Distributor B, or Packing
Shed B) that only packs or holds food, but does not manufacture/process
food (and therefore would not be required to have a supplier program)
before passing it on to Point C in the supply chain, which also would
not be required to have a supplier program (e.g., Retail Food
Establishment C or Consumer C). For example, if Packing Shed B
distributes produce it packs after receiving the produce from Farm A
directly to retail facilities (which would not be subject to the
requirements of this preventive controls rule), no supplier controls
would be applied to Farm A. Should verification activities be required
in circumstances in which a RAC such as fresh produce will not be sent
to any facilities that would be required to have preventive controls
before reaching consumers?
    The potential supplier program would be included in the food safety
plan and, thus, would be prepared (or overseen) by a qualified
individual (see proposed Sec.  117.126(b)(7)). A supplier program could
be established and maintained by a facility's corporate headquarters or
parent entity. The recordkeeping requirements would specify that
electronic records are considered to be onsite if they are accessible
from an onsite location, and we expect that many records for the
supplier program would be in electronic form (and thus easily
retrievable by a facility during an inspection).
    Rather than specifically require a written list of approved
suppliers, the potential requirements would specify that the supplier
program be written and include verification activities, as appropriate
to the hazard, and documentation of such activities, to ensure products
are received only from suppliers approved for control of the hazard(s)
in that raw material or ingredient (or, when necessary and appropriate,
on a temporary basis from unapproved suppliers whose raw materials or
ingredients the receiving facility subjects to adequate verification
activities before acceptance for use). Such a program could include,
for example, written procedures for approving suppliers, for approving
(or rejecting) specific raw materials and ingredients, and for
documenting that raw materials or ingredients are only received from
approved suppliers. The potential requirements would recognize that
there can be circumstances that would require a facility to receive raw
materials or ingredients on a temporary basis from an unapproved
supplier (e.g., if there is a disruption in delivery of raw materials
and ingredients from approved suppliers due to circumstances such as
localized flooding or malfunctioning equipment). We request comment on
examples of circumstances when it would be necessary and appropriate to
receive raw materials and ingredients on a temporary basis from an
unapproved supplier and on the types of verification activities that a
facility should conduct on food from an unapproved supplier.
    The potential requirements would provide flexibility for the
verification activities that the receiving facility would conduct for
raw materials and ingredients. With one exception, the receiving
facility would have flexibility to select one or more of four possible
activities: (1) onsite audit; (2) sampling and testing of the raw
material or ingredient, which could be conducted by either the supplier
or the receiving facility; (3) review by the receiving facility of the
supplier's relevant food safety records; and (4) other appropriate
supplier verification activities based on the risk associated with the
ingredient and the supplier. To determine which option is appropriate,
the receiving facility could consider (1) the severity of the hazards;
(2) where the preventive controls for those hazards are applied (such
as at the supplier or the supplier's supplier); (3) the supplier's
procedures, processes, and practices related to the safety of the raw
materials and ingredients; (4) applicable FDA food safety regulations
and information relevant to the supplier's compliance with those
regulations, including an FDA warning letter or import alert relating
to the safety of the food; (5) the supplier's food safety performance
history relevant to the raw materials or ingredients that the receiving
facility receives from the supplier, including available information
about results from testing raw materials or ingredients for hazards,
audit results relating to the safety of the food, and responsiveness of
the supplier in correcting problems; and (6) any other factors as
appropriate and necessary, such as storage and transportation. Thus, a
receiving facility would have flexibility to select a verification
activity based on the circumstances.
    The exception would be when there is a reasonable probability that
exposure to the hazard will result in serious adverse health
consequences or death to humans. In this circumstance, under the
potential supplier program, the receiving facility would be required to
have documentation of an onsite audit of the supplier before using the
raw material or ingredient from the supplier and at least annually
thereafter. The potential requirement for an annual audit is limited to
when there is a reasonable probability that exposure to the hazard will
result in serious adverse health consequences or death to humans.
Further, the receiving facility could select less frequent audits or a
different verification activity, if it documented its determination
that the less frequent onsite auditing or other verification activity
provides adequate assurance that the hazards are controlled. The
potential recordkeeping requirements that would apply to audits would
identify specific information that the records must provide about the
audit, including the conclusions of the audit, but would not specify
that the underlying audit report is part of the required documentation
of an audit.
    A person who conducts an audit would need to be qualified to do so.
To be qualified, a person who conducts an audit (``qualified auditor'')
would be required to satisfy the criteria for a ``qualified
individual'' (a person who has successfully completed training in the
development and application of risk-based preventive controls
equivalent to that of an FDA-recognized standardized curriculum or is
otherwise qualified through job experience to develop and apply a food
safety system) and have technical expertise obtained

by a combination of training and experience appropriate to perform the
auditing function.
    The potential supplier program would require the receiving facility
to know the FDA food safety regulations that apply to the supplier, and
relevant information about the supplier's compliance with those
regulations. The focus of section 418 of the FD&C Act is on preventing
food safety problems rather than on reacting to them. Section 418 of
the FD&C Act requires the owner, operator, or agent in charge of a
facility to establish and implement preventive controls to
significantly minimize or prevent known or reasonably foreseeable
hazards. By specifying that supplier verification activities are a
preventive control, section 418 requires the receiving facility to take
necessary actions to ensure that raw materials and ingredients are not
adulterated. To determine whether incoming raw materials and
ingredients are adulterated, a receiving facility would need to know
the regulatory framework that applies to the raw materials and
ingredients, and to have confidence that its supplier is complying with
that regulatory framework.
    The potential supplier program would include provisions to address
non-conformance by a supplier. This potential requirement would not
prescribe when a particular corrective action (such as discontinuing a
supplier) is necessary. A facility could substitute an inspection
(whether by FDA or by the food safety authority of a country whose food
safety system FDA has officially recognized as comparable or determined
to be equivalent to that of the United States) for an audit. Even
though inspection procedures and audit procedures are not identical, we
tentatively conclude that a facility should have flexibility to
determine whether an inspection could substitute for an audit based on
characteristics such as the severity of the hazard, how the supplier
controls the hazard, and the supplier's performance history. For
example, a facility that receives pickles from a facility subject to
the acidified foods regulations in 21 CFR 114 may conclude that an FDA
inspection for compliance with acidified foods regulations (concluding
that no action is indicated) provides adequate assurance that the
facility is producing pickles in compliance with the requirements of
applicable FDA food safety regulations and that the pickles are not
adulterated under section 402 of the FD&C Act. For additional
discussion of our reasons for tentatively concluding that it would be
appropriate to substitute an inspection (whether by FDA or by the food
safety authority of a country whose food safety system FDA has
officially recognized as comparable or determined to be equivalent to
that of the United States) for an audit, see the discussion in the
proposed FSVP rule (78 FR 45730 at 45758). In addition, we are asking
for comment on whether it would be appropriate to substitute an
inspection in another country (Country A) for an audit when, for
example, it is the food safety authority of Country B (whose food
safety system FDA has officially recognized as comparable or determined
to be equivalent to that of the United States) that conducted the
inspection in Country A.
    The potential requirements would provide for alternative
verification requirements when a supplier subject to the requirements
of section 418 of the FD&C Act is a qualified facility subject to
modified requirements. Section 418 provides different requirements for
qualified facilities, which are reflected in the different potential
verification requirements for such facilities. Although the potential
requirements would allow a receiving facility to conduct an alternative
verification activity when the supplier is a qualified facility, they
would not require this.
    Likewise, the potential requirements would provide for alternative
verification requirements when a supplier is a farm that would not be
subject to the requirements of proposed Sec.  112.4 regarding the raw
material or ingredient that the receiving facility receives from the
farm. Some of these farms would be not be subject to the requirements
of proposed Sec.  112.4 because they satisfy the criteria, in section
419(f) of the FD&C Act, for an exemption for direct farm marketing.
Other farms would not be subject to the requirements of proposed Sec.
112.4 because the crops they grow would not be covered by the proposed
produce safety rule, either based on the findings of a qualitative
assessment of risk associated with growing, harvesting, packing, and
holding of produce (see the discussion of this qualitative assessment
of risk in the 2013 proposed produce safety rule, 78 FR 3504 at 3508
and 3522-3529) or because they account for a very small percentage of
covered produce (see proposed Sec.  112.4 and the discussion at 78 FR
3504 at 3549). Although the potential requirements would allow a
receiving facility to conduct an alternative verification activity for
such farms, they would not require this. Although the potential
requirements would provide for alternative verification requirements
for farms that would not be subject to the produce safety rule, we
would not issue a final rule on such alternative verification
requirements until we issue the final produce safety rule.

D. Request for Additional Comment on Requirements To Address Conflicts
of Interest for Persons Conducting Verification Activities

    In the 2013 proposed FSVP rule, we tentatively concluded that it
would be appropriate to address the independence of individuals
conducting verification activities (78 FR 45730 at 45759). We proposed
that an individual who conducts any verification activity must not have
a financial interest in the foreign supplier and payment must not be
related to the results of the activity, and provided that this would
not prohibit an importer, or the importer's employee, from conducting
the verification activity (proposed Sec.  1.506(g)). As discussed in
the 2013 proposed FSVP rule, we considered such requirements necessary
to prevent bias, or the appearance of bias, on the part of a person
conducting a verification activity (78 FR 45730 at 45759).
    We request comment on whether we should include in the final
preventive controls rule requirements to address conflicts of interest
for individuals conducting verification activities and, if so, the
scope of such requirements. For example, should such requirements be
directed to a subset of persons who conduct verification activities
(such as auditors) or should they be directed more broadly? Would a
requirement such as in the 2013 proposed FSVP rule be appropriate, or
would some other requirement be more appropriate (such as a requirement
that persons be free of conflicts of interest that are relevant to the
outcome of the activity)? What would constitute a financial interest in
a company sufficient to constitute a conflict of interest for a person
conducting a supplier verification activity (e.g., conducting an audit
of that company or conducting laboratory tests of that company's food)?

XII. Potential Requirements for the Hazard Analysis To Address
Economically Motivated Adulteration

A. Our Request for Comment on Whether the Final Rule Should Address
Economically Motivated Adulteration

    In the 2013 proposed preventive controls rule, we announced our
intent to implement the statutory requirements for hazards that may be
intentionally introduced, including by acts of terrorism, in a separate
rulemaking rather than include them in the requirements for hazard
analysis and

risk-based preventive controls (78 FR 3646 at 3659). We tentatively
concluded that intentional hazards, which are not addressed in
traditional HACCP or other food safety systems, likely will require
different kinds of controls and would be best addressed in a separate
rulemaking. However, we also acknowledged that some kinds of
intentional adulterants could be viewed as reasonably likely to occur,
e.g., in foods concerning which there is a widely recognized risk of
economically motivated adulteration in certain circumstances. We
provided an example of this kind of hazard--i.e., the addition of the
chemical melamine to certain food products, apparently to enhance the
measured protein content and/or perceived quality. We requested comment
on whether to include potential hazards that may be intentionally
introduced for economic reasons. We also requested comment on when an
economically motivated adulterant can be considered reasonably likely
to occur.
    When we developed the 2013 proposed intentional contamination rule,
we tentatively concluded that economically motivated adulteration would
be best addressed through the approach in the preventive controls rules
for human food and for animal food (including hazard analysis,
preventive controls, monitoring, corrective action, verification, and
recordkeeping) rather than through the vulnerability assessment-type
approach for intentional adulteration, where the intent is to cause
wide-spread public health harm, such as acts of terrorism (see the 2013
proposed intentional adulteration rule, 78 FR 78014 at 7802). We also
explained our view that the primary purpose of economically motivated
adulteration is to obtain economic gain rather than to impact public
health, although public health harm may occur (78 FR 78014 at 78020).

B. Comments on Economically Motivated Adulteration

    Some comments oppose including requirements directed to
economically motivated adulteration in the preventive controls rule.
These comments assert that the vast majority of economically motivated
adulterants affect quality and value rather than safety. These comments
also point out that the majority of food products could, in theory, be
subject to economically motivated adulteration but that it would be
difficult to determine if such adulteration is reasonably foreseeable.
One comment recommends that we draw a clear distinction between hazards
that are intentionally introduced and those that are not. Another
comment expresses the view that food fraud is fundamentally different
from both food safety and food defense. However, some comments do
support including ``expected intentional adulterants'' in the
preventive controls rule and note that the U.S. Pharmacopeial
Convention (USP) has a free on-line food fraud database (Ref. 25). (USP
is a scientific nonprofit organization that sets standards for the
identity, strength, quality, and purity of medicines, food ingredients,
and dietary supplements manufactured, distributed and consumed
worldwide.)

C. Potential Requirements To Address Economically Motivated
Adulteration

    Taking into account the comments we have reviewed so far, we are
providing an opportunity for public comment on a potential requirement
for the hazard identification to consider hazards that may be
intentionally introduced for purposes of economic gain (see proposed
Sec.  117.130(b)(2)(iii) in proposed subpart C). In this section of
this document, we are reopening the comment period with respect to our
previous request for comment on whether to include potential hazards
that may be intentionally introduced for economic reasons. We are
seeking comment on whether this preventive controls rule would be the
most appropriate rule to address FSMA's requirements to address hazards
that may be intentionally introduced (for purposes of economic gain)
and, if so, what (if any) modifications to the proposed regulatory text
would be appropriate. We note that the preliminary regulatory impact
analysis (PRIA) that presents the benefits and costs of this proposed
rule (Ref. 26) describes certain assumptions we are making about the
preventive controls, and their implementation, that would be
established and implemented by a facility that identifies a potential
hazard that may be intentionally introduced for economic reasons as a
significant hazard. We are seeking comment on alternative ways to
control such hazards.
    Under the definitions that would be established in the rule, a
hazard would be an agent that is reasonably likely to cause illness or
injury in the absence of its control. Thus, the focus of the potential
requirement would be on those economically motivated adulterants that
are reasonably likely to cause illness or injury in the absence of
their control, not on economically motivated adulterants that solely
affect quality and value with little or no potential for public health
harm.
    We believe that it is practicable to determine whether economically
motivated adulteration is reasonably foreseeable. Importantly, we would
not expect facilities to consider hypothetical economically motivated
adulteration scenarios for their food products. As discussed in the
2013 proposed intentional adulteration rule, we would expect facilities
to focus on circumstances where there has been a pattern of such
adulteration in the past, suggesting a potential for intentional
adulteration even though the past occurrences may not be associated
with the specific supplier or the specific food product (78 FR 78014 at
78027). For example, in both the 2013 proposed preventive controls rule
and the 2013 proposed intentional contamination rule we discussed a
widespread incident of economically motivated adulteration in which
some milk firms in one country added melamine, a nitrogen-rich
industrial by-product, to diluted dairy products to increase the
apparent protein content (78 FR 3646 at 3659 and 78 FR 78014 at 78021,
respectively). This adulteration resulted in significant public health
consequences, with more than 290,000 ill infants and 6 deaths in that
country. In light of this incident, a prudent person would include in
its hazard analysis the potential for melamine to be an economically
motivated adulterant in a facility's food products when using milk
products from a country where melamine adulteration had occurred and,
based on the outcome of that hazard analysis, determine whether
melamine is a hazard that must be addressed in the food safety plan. As
none of this adulterated milk was exported to the United States and no
US suppliers have been a source of food safety problems due to milk
products adulterated for economic gain, FDA does not expect a facility
to consider the potential for melamine to be a significant hazard when
using domestic milk products, or milk products from other countries
when there is no history of melamine adulteration associated with those
countries.
    There are other well-known substances that have been used in
economically motivated adulteration schemes, have potential to cause
public health harm, and would be prudent to consider in the types of
food products that have been the subject of these schemes. For example,
dyes containing the heavy metal lead have been added to ingredients
such as spices to enhance color. Lead can accumulate in the body over
time and can cause health problems, including such as impaired

cognitive development in children (Ref. 27). Lead chromate is a
chemical with a vibrant yellow color that has been used as an
adulterant in turmeric to change the color of the spice to suggest that
it is of a higher quality (Ref. 28). Lead oxide is a red chemical that
has been used as an adulterant in paprika to change the color of the
spice to suggest that it is of a higher quality; in 1995, an incident
was reported in Hungary in which dozens of people were made ill and
several people died as a result of consuming contaminated paprika (Ref.
29). Sudan I is an orange-red powder that had been added to chili
powder as a coloring agent, but is now banned in many countries because
the International Agency for Research on Cancer has classified it as a
category 3 carcinogen (not classifiable as to its carcinogenicity to
humans) (Ref. 30); in 2005, contamination of an ingredient prepared
using chili powder containing Sudan I led to a massive recall of food
products in the United Kingdom (Ref. 31).
    In addition to the food-fraud database mentioned in the comments, a
recent report from the Congressional Research Service provides
additional information on economically motivated adulteration of food
and food ingredients (Ref. 32). A recent report identified 137 unique
incidents in 11 food categories (Ref. 33).

XIII. Provisions for Withdrawal of an Exemption for a Qualified
Facility

A. 2013 Proposed Provisions for Withdrawal of an Exemption for a
Qualified Facility

    In the 2013 proposed preventive controls rule, we explained the
provisions of FSMA that establish criteria for a facility to be a
qualified facility, establish an exemption for qualified facilities,
establish modified requirements for qualified facilities, and provide
that we may withdraw the exemption otherwise granted to qualified
facilities in specified circumstances (section 418(l) of the FD&C Act;
see 78 FR 3646 at 3657). We proposed to establish:
    Definitions relevant to these provisions (proposed Sec.  117.3);
    An exemption from the requirements for hazard analysis and risk-
based preventive controls for qualified facilities (proposed Sec.
117.5(a));
    Modified requirements for qualified facilities (proposed Sec.
117.201); and
    Procedural requirements that would govern our withdrawal of an
exemption for a qualified facility (proposed subpart E; the 2013
proposed withdrawal provisions) (see 78 FR 3702-3703, 3768-3771, and
3775-3780).
    The 2013 proposed withdrawal provisions would:
    Specify the circumstances under which we would withdraw an
exemption for a qualified facility (proposed Sec.  117.251);
    Establish procedures for us to issue an order to withdraw the
exemption, including information that would be in the order (proposed
Sec. Sec.  117.254 and 117.257);
    Establish procedures whereby a qualified facility may submit a
written appeal of our order to withdraw an exemption (proposed Sec.
117.260 and 117.264);
    Establish procedures for appeals, hearings, and decisions on
appeals and hearings (proposed Sec. Sec.  117.267, 117.270, 117.274,
and 117.277); and
    Specify the circumstances in which an order to withdraw an
exemption is revoked (proposed Sec.  117.280).

B. Proposed Clarification of What FDA Will Do Before Issuing an Order
and Proposed Mechanism for Re-Instating an Exemption

1. Comments
    Some comments generally support the overall framework of the 2013
proposed withdrawal provisions and express the view that withdrawal of
exemption should be both prompt and permanent to protect public health.
Some comments ask us to explain the difference between withdrawal of an
exemption and suspension of registration. One comment asks us to
clarify the effect a suspension has on a qualified facility and
recommends that suspension automatically result in loss of the
exemption. One comment recommends that we withdraw an exemption at the
earliest signs of problems, because doing so would be most protective
of public health and would be consistent with the principle that a
broad interpretation of statutory exemptions is disfavored when they
affect public health and safety. This comment also asserts that section
418 of the FD&C Act provides a very low threshold for initiating a
withdrawal action, makes that withdrawal permanent, and was designed to
operate on a ``one strike, you're out'' principle. This comment asserts
that the exemption section 418 provides to qualified facilities has no
basis in food safety science or sound policy and endangers consumers
and that withdrawal of an exemption would not result in overly harsh
consequences because it would not close the facility. One comment
discusses our authority to suspend the registration of a facility
(section 102 of FSMA). This comment contrasts FSMA's provisions for
withdrawal with those for suspension, noting that FSMA's provisions for
suspension specify a method to lift that suspension (i.e., submission
of a corrective action plan) but FSMA's provisions for withdrawal of an
exemption provide no remedy for an exemption that is withdrawn.
    In contrast, other comments express concern that the 2013 proposed
withdrawal provisions fail to establish a fair and clear process for
withdrawing a qualified facility's exempt status and recommend that we
revise the 2013 proposed withdrawal provisions to provide a more
flexible framework that would be both fair and clear. Some of these
comments express concern that withdrawal of an exemption would subject
very small and small facilities to unexpectedly high compliance costs
that could put them out of business. Some comments recommend that we
add a provision allowing a facility to voluntarily withdraw its
exemption. Some comments recommend more safeguards to ensure that the
process to withdraw an exemption is not abused. In general, these
comments recommend the following three principal revisions to the 2013
proposed withdrawal provisions:
    Establish a high threshold for withdrawing an exemption, including
an evidentiary standard that would apply to the criteria for
withdrawing an exemption;
    Provide for ``due process'' before we take steps to withdraw an
exemption, including an opportunity for a qualified facility to
maintain its exempt status (e.g., by addressing the specified issues of
concern); and
    Provide an opportunity for reinstatement of a withdrawn exemption.
    In the following paragraphs, we provide more detail about comments
recommending these three principal revisions.
    Threshold for withdrawing an exemption. Some comments assert that
the 2013 proposed withdrawal provisions are extremely vague and appear
to give us broad authority to withdraw an exemption from a qualified
facility without adequate evidence of an actual harm or likely severe
problem related to the facility's practices. Some comments assert that
we should narrowly interpret the statutory criteria for withdrawing an
exemption to avoid action that is arbitrary and capricious, and that to
do so we must show necessity and direct linkage between an active
investigation of a foodborne illness outbreak and the qualified
facility. Some of these comments

recommend that we define and clarify key terms (including ``directly
linked,'' ``necessary,'' ``associated,'' and ``material to the safety
of food''). Some of these comments also recommend that we introduce a
standard (such as ``credible evidence'' or ``credible and substantial
evidence'' that shows direct linkage to a problem at a specific
facility) that would require us to meet an explicit evidentiary
threshold when we find that conduct or conditions exist in a qualified
facility sufficient to warrant withdrawal of an exemption. Some
comments recommend that the final withdrawal provisions explicitly
provide that the credible and substantial evidence would only apply to
an individual facility, and would not apply to a group or class of
facilities.
    Due process before withdrawing an exemption. Some comments note
that we have many enforcement tools that we can use in lieu of
withdrawing an exemption, particularly if there is an immediate risk to
public health. These include seeking an injunction (21 U.S.C. 332;
section 302 of the FD&C Act); seizing the food at issue (21 U.S.C.
334(a)-(f); section 304(a)-(f) of the FD&C Act); and administrative
detention of the food (21 U.S.C. 334(h); section 304(h) of the FD&C
Act). Other comments note that we have a history of providing a
facility with opportunities to fix a problem before starting such an
enforcement action (e.g., by issuing a warning letter). These comments
recommend that we provide such opportunities to qualified facilities
before we take steps to withdraw an exemption.
    Some comments recommend that the final withdrawal provisions allow
for partial withdrawal of an exemption in which FDA would indicate
specific sections of the rule that the facility must comply with. These
comments assert that small businesses should be able to seek targeted
solutions as needed without falling under all the substantive, costly
provisions of the rule. Some comments recommend that the final
withdrawal provisions establish a three-tiered process--Tier 1: Warning
letter; Tier 2: Temporary conditional withdrawal of an exemption; and
Tier 3: Full withdrawal of an exemption. For example, a warning letter
would identify the material conduct or conditions in question or how
the facility is directly linked to an active investigation of a
foodborne illness outbreak; include information about how the facility
could remedy the situation; and notify the facility that it has 15
calendar days from receipt of the warning letter to respond with a plan
for remedying the problem within a suitable timeframe. These comments
state that if the facility does not adequately address the problem in
its response to the warning letter and subsequent actions to correct
the problem, we would issue a temporary (e.g., six months) conditional
withdrawal, targeted to a particular issue, outlining how the facility
can remedy the problem. These comments further state that if the
facility still fails to correct the problem after receiving the
temporary conditional withdrawal, we would proceed with steps for full
withdrawal of an exemption.
    Reinstatement of an exemption that was withdrawn. Some comments
recommend that we provide a process for each of three situations in
which a qualified facility might regain its exemption status:
    Before reaching the deadline for compliance specified in the
withdrawal order, if the facility demonstrates that the conduct or
conditions that triggered the withdrawal order have been sufficiently
resolved;
    After the compliance deadline passes if, during an informal
hearing, the facility can show that the conduct or conditions that
triggered the withdrawal have been sufficiently resolved; or
    Automatically if we determine, after finishing an active
investigation of a foodborne illness outbreak, that the outbreak is not
directly linked to the facility.
    2. Specific Proposed Additions and Modifications to the 2013
Proposed Withdrawal Provisions
    As discussed more fully in the following paragraphs, taking into
account the comments we have reviewed so far we are proposing to modify
the 2013 proposed withdrawal provisions to:
    Include specific regulatory actions that we must take, and other
regulatory actions that we may consider, before we issue an order to
withdraw an exemption (proposed Sec.  117.251(b));
    Clarify that an order to withdraw an exemption must be approved by
an FDA District Director before it can be issued (proposed Sec.
117.254(a) and (b)); and
    Provide a process for reinstating an exemption that has been
withdrawn (proposed Sec.  117.287).
    See the revised regulatory text for proposed Sec. Sec.  117.251(b),
117.254(a) and (b), and 117.287. In this section of this document, we
are reopening the comment period with respect to these specific
proposed provisions.
    Both of the proposed circumstances for withdrawal of an exemption
specify significant public health reasons for doing so, related to an
outbreak of foodborne illness, or being necessary to protect the public
health and prevent or mitigate a foodborne illness outbreak based on
conduct or conditions associated with the qualified facility that are
material to the safety of the food manufactured, processed, packed, or
held at such facility (proposed Sec. Sec.  117.251(a) and (b),
respectively). We do not consider it necessary to define terms such as
``directly linked,'' ``necessary,'' ``associated,'' or ``material to
the safety of food,'' or to introduce a standard (such as ``credible
evidence'' or ``credible and substantial evidence'' that shows direct
linkage to a problem on a specific farm or facility) to provide for a
fair process that is neither arbitrary nor capricious.
    We may suspend the registration of a facility if we determine that
food manufactured, processed, packed, received, or held by the facility
has a reasonable probability of causing serious adverse health
consequences or death to humans or animals. If we suspend a facility's
registration, no person can import or export food into the U.S. from
such facility, offer to import or export food into the U.S. from such
facility, or otherwise introduce food from such facility into
intrastate or interstate commerce in the U.S. (See section 415(b) of
the FD&C Act (21 U.S.C. 350d(b)). In contrast, we may withdraw an
exemption from a qualified facility in two circumstances: (1) In the
event of an active investigation of a foodborne illness outbreak that
is directly linked to the qualified facility; or (2) if we determine
that it is necessary to protect the public health and prevent or
mitigate a foodborne illness outbreak based on conditions or conduct
associated with the qualified facility that are material to the safety
of the food manufactured, processed, packed, or held at such facility.
(See section 418(l)(3) of the FD&C Act). A facility that loses its
exemption may distribute food if it is in compliance with applicable
requirements.
    The statutory criteria for suspension of registration are separate
and distinct from the statutory criteria for withdrawal of an exemption
and must be considered separately. Suspension of a facility's
registration does not change a facility's status as a qualified
facility. If we take steps to suspend a qualified facility's
registration, we may also separately consider whether the circumstances
that may lead us to withdraw the facility's exemption exist and, if so,
may follow the process that would be established in the final
withdrawal provisions for doing so.
    As the comments point out, in many circumstances we have provided
facilities with opportunities to fix a

problem before starting an enforcement action. Indeed, we consider that
issuing an order to withdraw an exemption would be a rare event, in
part because alternative actions may provide a more expeditious
approach to correcting a problem than withdrawing an exemption.
However, taking into account the concerns expressed in the comments we
have reviewed so far, we are proposing to include specific actions that
we must take, and other actions that we may consider, before we issue
an order to withdraw an exemption. (See the revised regulatory text for
proposed Sec.  117.251(b)). Briefly, the proposed regulatory text would
provide that we:
    Notify a qualified facility in writing of circumstances that may
lead us to withdraw its exemption, and provide an opportunity for the
facility to respond, before we issue an order to withdraw the
exemption;
    May consider alternative regulatory actions before issuing an order
to withdraw an exemption; and
    Consider actions taken by the facility to address the circumstances
that may lead us to withdraw its exemption before issuing an order to
withdraw the exemption.
    We are not proposing that we always must take steps to withdraw an
exemption at the earliest signs of problems. Not all problems would
satisfy the statutory threshold for withdrawal of the exemption.
Further, we believe it is appropriate to consider each situation on its
individual merits, such as whether there are illnesses, whether there
are significant violations that could have contributed to the problem,
whether the facility has taken corrective actions to address the
problem, and whether the actions taken are likely to prevent a
reoccurrence of the situation. Moreover, FDA has other tools that may
be available to more quickly protect public health, including recall
and administrative detention.
    Regarding reinstatement, we tentatively conclude that the absence
of a specific provision in section 418 of the FD&C Act for the re-
instatement of an exemption that is withdrawn does not preclude us from
providing for such a process, by which a facility may regain its status
as a qualified farm. The proposed regulatory text (see proposed Sec.
117.287) would:
    Provide that we could reinstate an exemption on our own initiative
or in response to a written request from the facility;
    Require that a written request from a facility include such data
and information as are necessary to demonstrate that the facility has
adequately resolved the problems with the conditions or conduct that
are material to the safety of the food manufactured, processed, packed,
or held at the facility, such that continued withdrawal of the
exemption is not necessary to protect public health and prevent or
mitigate a foodborne illness outbreak;
    Provide that if we had withdrawn the exemption due, in whole or in
part, to an active investigation of a foodborne illness outbreak that
had been directly linked to the qualified facility and later determine,
after finishing the active investigation, that the outbreak was not
directly linked to the facility, we would either;
    Reinstate the exemption (if the only reason for the withdrawal had
been the outbreak investigation); or
    Inform the facility of our finding that the outbreak investigation
was not directly linked to the facility, and provide an opportunity for
the facility to request reinstatement (if the exemption was withdrawn,
in part, due to conditions and conduct that are material to the safety
of the food manufactured, processed, packed, or held at the facility).
    We are not proposing to provide for partial withdrawal of an
exemption or establish the three-tiered process recommended in the
comments (i.e., Warning letter; Temporary conditional withdrawal of an
exemption; and Full withdrawal of an exemption). Such a process is not
required by section 418 and would deprive FDA of needed flexibility to
address the varying circumstances that might give rise to a possible
withdrawal of the exemption. Further, the revised regulatory text
provides for a qualified facility to receive written notification that
circumstances may lead us to withdraw an exemption, and provides an
opportunity for the facility to respond. FDA will consider this
response and actions taken by the facility in determining whether to
withdraw the exemption. In addition the newly proposed provision for
reinstatement of an exemption provides an opportunity for a facility to
return to its status as a qualified facility.

C. Proposed Revisions to the Content of an Order To Withdraw an
Exemption

    In this section of this document, we are reopening the comment
period with respect to proposed Sec.  117.257(d).
    Some comments recommend that the order explicitly state that the
facility has the option to either comply with the order or appeal the
order (with a request for an informal hearing) within 10 calendar days.
    We tentatively conclude that it would be useful for the order to
itself specify the two options that a facility has upon receipt of the
order, even though the order would otherwise include this information
(because the order will contain the full text of the withdrawal
provisions). Therefore, we are proposing to revise the requirements for
the contents of an order to explicitly mention these two options. See
the revised regulatory text of proposed Sec.  117.257(d).

D. Proposed Revisions to the Timeframes for a Facility To Comply With,
or Appeal, an Order

    In this section of this document, we are reopening the comment
period with respect to the timeframes in proposed Sec. Sec.  117.257(d)
and 117.260(a) and (c).
1. Comments
    Some comments ask us to specify that a facility's timeframe for
taking action begins when the facility receives the order, not when we
issue the order. Other comments address the timeframes for a facility
to compile information needed to appeal an order for withdrawal. These
comments assert that the proposed timeframe of 10 days is insufficient,
and recommend timeframes such as 30 days or 90 days.
    Some comments contrast the proposed 60-day timeframe to comply with
the requirements for hazard analysis and risk-based preventive controls
when a facility loses its exemption as a qualified facility with the
timeframe that a facility would have to comply with these requirements
when the final rule first becomes effective. As discussed in the 2013
proposed preventive controls rule, we proposed compliance dates that
would be 2 years and 3 years after the date of the final rule for small
and very small businesses, respectively. These comments assert that
these two situations are parallel, because a qualified facility that
has had its exemption withdrawn would be coming into compliance with
the full requirements for hazard analysis and risk-based preventive
controls for the first time. These comments recommend that we change
the timeframes in the 2013 proposed withdrawal provisions to better
align with the compliance dates contemplated by the proposed rule and
by FSMA for small and very small businesses. Some of these comments
recommend that a small business have 6 months, and that a very small
business have 18 months, to comply with the order. Other comments
recommend that any business (whether small or very small) have two
years to comply with

the order. Some of these comments recommend that the timeframe be tied
to the date of the final determination rather than to the date of the
order.
2. Proposed Revisions to Timeframes
    We tentatively conclude that the nature of what a facility would
need to do to comply with an order--i.e., comply with the full
requirements for hazard analysis and risk-based preventive controls--
makes the timeframes in the 2013 proposed withdrawal provisions
insufficient. However, it is relevant that in contrast to the general
compliance dates, the proposed withdrawal provisions would only apply
when a significant public health concern has been identified for a
particular facility.
    We also tentatively conclude that it is appropriate to link the
timeframe for compliance to the date of receipt of the order, rather
than to the date the order was issued. Doing so would be consistent
with our other administrative procedures, such as appeal of an order
for administrative detention (Sec.  1.402).
    Taking into account the comments we have reviewed so far, we are
proposing to require that a facility comply with an order to withdraw
an exemption within 120 days of the date of receipt of the order. See
the revised regulatory text for proposed Sec. Sec.  117.257(d) and
117.260(a) and (c).

XIV. Definition of Very Small Business

A. The 2013 Proposed Options for Definition of Very Small Business

    We proposed three options for the definition of a very small
business based on total annual sales of food, adjusted for inflation:
Option 1, $250,000; Option 2, $500,000; and Option 3, $1,000,000. The
2013 proposed preventive controls rule contained several provisions
relevant to very small businesses, including exemptions from subpart C
in Sec.  117.5(g) and Sec.  117.5(h) for very small (and small)
facilities engaged only in specific types of on-farm activities
involving low-risk activity/food combinations, the exemption inSec.
117.5(a) and modified requirements in Sec.  117.201 for a very small
business as a qualified facility, and extended time to comply with the
rule. In defining a very small business, we took into consideration the
study of the food processing sector required by section 418(l)(5) of
the FD&C Act (``Food Processing Sector Study'' (Ref. 34); see 78 FR
3646 at 3700-3701). In the 2013 proposed preventive controls rule we
requested comment regarding the three proposed options for the
definition of ``very small business.'' We also requested comment on
whether a dollar amount of sales that is more than, or less than, the
$250,000, $500,000, or $1,000,000 amounts would be appropriate.

B. Comments on the 2013 Proposed Options for Definition of Very Small
Business

    Comments support a variety of dollar limits of total annual sales
of food for defining a very small business, including each of the three
proposed options ($250,000, $500,000, and $1,000,000) as well as other
dollar limits that we did not include as proposed options (i.e.,
$2,000,000, $5,000,000 and $10,000,000). Comments assert that very
small facilities will incur a large portion of the costs associated
with implementing the 2013 proposed preventive controls rule because
very small facilities lack experience with HACCP-based models.
    Some comments support defining a very small business as one with
total annual food sales up to $1,000,000. Some of these comments
express concern that using lower dollar sales amounts to define a very
small business would discourage growth of very small processing
facilities (especially those co-located on a farm), would unfairly
burden very small facilities, and could cause them to fail due to the
estimated high cost of compliance; whereas setting a higher dollar
sales amount would encourage growth, innovation and diversification.
Some of these comments note that adopting the threshold of $1,000,000
would establish that the full preventive controls requirements would
apply to the businesses that produce the vast majority of food products
and that modified requirements would apply to smaller businesses that
represent the majority of producers but the minority of the food
supply.
    Other comments support defining a very small business as one with
total annual food sales up to $500,000. These comments maintain that
the $500,000 limit would simplify the definition of a qualified
facility, and make it easier for us to enforce than a lower dollar
amount, because facilities would not need to calculate how much of
their sales were to qualified end-users (as they would under section
418(l)(1)(C) of the FD&C Act).
    Other comments support defining a very small business as one with
total annual food sales up to $250,000. These comments maintain that
the $250,000 limit would exempt the fewest facilities among the three
proposed options and that this would be in the interest of public
health. Comments assert that higher dollar limits would remove from the
coverage of the 2013 proposed preventive controls rule precisely those
companies whose practices would be most improved by it. Some of these
comments evaluate the $250,000 limit in the context of section 418(l)
of the FD&C Act, which defines a qualified facility as either a very
small business or a business with annual sales of less than $500,000,
provided a majority of its sales are made directly to qualified end-
users. These comments note that the options with a limit higher than
$250,000 would equal or exceed the amount allowed for sales by
qualified facilities to nonqualified end users under section
418(l)(1)(C) of the FD&C Act and assert that statutory structure and
intent of section 418(l) of the FD&C Act make the proposed $250,000
limit the only available option from among the three options we
proposed. The comments also assert that the close producer-customer
relationship was a control for safety when a business is smaller than
$500,000 in sales and primarily sells directly to consumers or locally
to food retailers and restaurants.
    Some comments support defining a very small business as one with
total annual food sales up to $2,000,000, $5,000,000 or $10,000,000. In
general, these comments express concern about the costs associated with
implementing the requirements for hazard analysis and risk-based
preventive controls. For example, the comments assert that these costs
would deter small farms with gross annual sales between $250,000 and $5
million from expanding their businesses (e.g., to develop value-added
products), particularly when annual food sales include foods that would
not be not covered by the requirements for hazard analysis and risk-
based preventive controls (such as for animal food, whole produce, and
low-risk activity/food combinations conducted by a small or very small
business co-located on a farm), and the sales would largely be to
qualified end-users. A comment recommending a $10,000,000 limit
expresses concern that the costs associated with implementing the
requirements for hazard analysis and risk-based preventive controls
would be passed on to consumers.
    Some comments do not support defining a very small business based
on total annual food sales and recommend an alternative definition
based on the number of employees (e.g., fewer than 20 employees). These
comments assert that defining very small business based on number of
employees would be consistent with the proposed definition of small
business (which is based on number of employees) and with the smallest
establishment size in the Food

Processing Sector Study. Other comments support using a combination of
criteria for defining a very small business, including gross sales,
number of employees and risk level of the food being prepared.
    Some comments support using the volume of food rather than total
annual food sales. Some comments express concern that the dollar sales
would be applied to all food sold, including food for animals, and
recommend that we base the value on food subject to the preventive
controls for human food rule, on produce and processed food, on human
food (excluding animal feed) or on ``high-risk processed foods.''

C. Proposed Revisions to the Definition of Very Small Business

    In this supplemental notice of proposed rulemaking, we are
proposing the definition of very small business as a business that has
less than $1,000,000 in total annual sales of human food adjusted for
inflation. This definition would, as recommended by some comments,
simplify a facility's determination of whether it is a qualified
facility because the facility would only need to calculate its total
sales of human food rather than determine how much food was sold to
qualified end-users. The statutory construct does not prevent us from
establishing a definition for very small business that would include
more facilities than those that would be included under the statutory
provision that considers sales to qualified end-users (section
418(l)(1)(C) of the FD&C Act). Section 418(n)(1)(B) of the FD&C Act
directs FDA to define the term ``very small business'' for the purposes
of determining whether a facility is a ``qualified facility'' eligible
for modified requirements. Further, section 418(n)(1)(B) requires us to
consider the Food Processing Sector Study for the purpose of defining
``very small business.'' FDA notes that section 418 of the FD&C Act
does not otherwise limit how FDA may define ``very small business.''
    We tentatively conclude that it is reasonable for the sales limit
in the definition of ``very small business'' to be directed to human
food rather than all food, including animal food. The proposed
definition of ``very small business'' in this document is consistent
with the proposed definition of ``very small business'' in the 2013
proposed rule ``Current Good Manufacturing Practice and Hazard Analysis
and Risk-Based Preventive Controls for Food for Animals'' (78 FR 64736,
October 29, 2013), which would define such a business with respect to
sales of animal food rather than all food. We do not expect that this
proposed change would have a significant effect on the number of
facilities that satisfy the definition of ``very small business,''
because most facilities subject to the statutory requirements for
hazard analysis and risk-based preventive controls do not make both
human and animal food. However, some facilities co-located on a farm
that would not satisfy the definition of ``very small business'' if the
limit on the sales of food includes animal food as well as human food
may fall within the revised definition that would include a limit only
on the sales of human food.
    We tentatively conclude that it is not necessary for the dollar
limit in the definition of ``very small business'' to be $250,000 or
less to protect public health. In the 2013 proposed preventive controls
rule, we estimated the number of facilities that would be affected by
the size specified in the definition of ``very small business.'' The
size specified in the definition of ``very small business'' would
affect the compliance dates, the exemptions for qualified facilities,
and the exemptions for on-farm low-risk packing and holding activity
food/combinations and on-farm low-risk manufacturing/processing
activity food/combinations (proposed Sec. Sec.  117.5(a), (g), and (h),
respectively) (see 78 FR 3646 at 3702). We noted that as a group,
businesses with less than $1,000,000 in total annual sales of foods
produce less than two percent of all food produced in the United States
when measured by dollar value. We acknowledge that this estimate of all
food produced in the United States is higher than the estimates for
lower dollar limits (one-half of one percent of all food produced in
the United States, or less than one-half of one percent of all food
produced in the United States, for limits of $500,000 or $250,000,
respectively). Regardless, under the revised definition the businesses
that would be exempt from the requirements for hazard analysis and
risk-based preventive controls would represent a small portion of the
potential risk of foodborne illness.
    In the proposed rule, we calculated the costs of the rule, and
estimated the percent of food produced in the United States that would
be subject to modified requirements (i.e., produced by qualified
facilities), by determining which facilities would be qualified based
on ``per facility'' sales. We believe our current calculation based on
firm sales rather than facility sales is more consistent with section
418(l)(1)(B). In the updated PRIA (Ref. 26), we compare the numbers and
their market share of qualified and non-qualified facilities under
different definitions for a very small business using (1) the method in
our original PRIA (the number of facilities with less than $1 million
in annual sales) and (2) the number of firms with less than $1 million
in annual sales (in which multiple facilities may be under the
ownership of one firm). As noted in the updated PRIA (Ref. 26), in the
final rule we will calculate the number of qualified facilities based
on sales on a ``per firm'' basis. Calculating sales at the ``per firm''
level, we estimate that, as a group, those businesses that have less
than $1,000,000 in total annual sales of foods produce less than one
percent of the dollar value of food produced in the United States that
would be covered by the rule without any special provisions for such
businesses (Ref. 26), roughly equivalent to the percentage of food
produced by very small businesses when the level for such entities is
set at $250,000 if the ``per facility'' method of calculation is used.
In contrast, higher dollar limits for very small business (such as the
$2,000,000 or $5,000,000 limits recommended in some of the comments)
using the ``per firm'' method would affect more of the food produced in
the United States (approximately one percent and two percent,
respectively, roughly equivalent to the levels of food affected when
the level is set at $500,000 and $1,000,000, respectively, using the
``per facility'' method) (Ref. 26). We tentatively conclude that the
definition of very small business should exempt from the rule only a
small percent of food to minimize the risk of foodborne illness and,
thus, are proposing a very small business definition of $1,000,000,
which would exempt less than one percent of the dollar value of food
produced in the United States. We request comment on this tentative
conclusion and whether we should consider other dollar limits for very
small business.
    A dollar limit in the definition of ``very small business'' greater
than $250,000 would not necessarily exempt those companies whose
practices would be most improved by complying with the requirements for
hazard analysis and risk-based preventive controls. The Food Processing
Sector Study (Ref. 34) concluded that there was no consistent pattern
across food categories in terms of which sizes of establishments
contribute most to foodborne illness risk (78 FR 3646 at 3701).
Moreover, the facilities that would be classified as qualified
facilities would be subject to modified requirements (see proposed

Sec.  117.201). Furthermore, all facilities that would be exempt from
the requirements for hazard analysis and risk-based preventive controls
would continue to be subject to the prohibitions in the Federal Food,
Drug, and Cosmetic Act against causing food to be adulterated or
misbranded and against distributing such food and to inspection by FDA.
    We are not proposing that the definition of ``very small business''
consider number of employees as well as dollar limits, be based on
number of employees for consistency with the definition of ``small
business,'' or be based on volume of food sold rather than on dollar
limits associated with sales of food. There are two alternative sets of
criteria to be a qualified facility. The criteria in section
418(l)(1)(C) of the FD&C Act are set out with regard to sales. We
believe it is appropriate for the other criteria (related to being a
``very small business'') similarly to be related to sales. As discussed
in the 2013 proposed preventive controls rule, we proposed number of
employees for the definition of ``small business'' in part because it
would be the same definition for small business as that which has been
established by the U.S. Small Business Administration under 13 CFR 121
for most food manufacturers. We continue to believe that the proposed
definition of ``small business,'' based on number of employees, is
appropriate.
    We are not proposing that the definition of ``very small business''
consider the risk associated with the food manufactured, processed,
packed or held by the facility. The description ``very small''
addresses size of a business, not risk associated with food the
facility manufactures, processes, packs, or holds.

XV. Other New and Revised Proposed Provisions

A. Proposed New Definitions

1. Proposed Definition of ``Pathogen''
    In the 2013 proposed rule, we proposed to define ``environmental
pathogen'' to mean a microorganism that is of public health
significance and is capable of surviving and persisting within the
manufacturing, processing, packing, or holding environment. Variations
of the phrase ``microorganism of public health significance'' appear in
several places in the existing CGMP regulations and in the 2013
proposed preventive controls rule. To both simplify the regulations and
use the same term (i.e., ``pathogen'') when we mean a microorganism of
public significance, we are proposing to define the term ``pathogen''
to mean a microorganism that is of public health significance and to
replace variations of the phrase ``microorganism of public health
significance'' with ``pathogen'' throughout the regulations.
2. Proposed Definition of ``You''
    In the 2013 proposed preventive controls rule, we requested comment
on whether there is any meaningful difference between the persons
identified in current part 110 (i.e., ``plant management'' and
``operator'') and the ``owner, operator, or agent in charge''
identified in section 418 of the FD&C Act. We also requested comment on
whether it would be appropriate to refer to the ``owner, operator, or
agent in charge'' of a plant, establishment, or facility throughout
proposed part 117 and, if so, whether the requirements would be clear
if we revised the proposed rule to use pronouns (such as ``you'' and
``your'') within proposed part 117.
    Comments that responded to this request for comment focused on an
approach that would make the regulations clear. However, the comments
were divided in terms of how to best provide clarity, particularly with
respect to use of pronouns such as ``you'' and ``your.'' Some of these
comments express concern that it would be confusing if the phrase
``owner, operator, or agent in charge'' applied both to plant
management and operators in the CGMP requirements (proposed subpart B,
derived from current part 110) and to the ``owner, operator, or agent
in charge of a facility'' in the requirements for hazard analysis and
risk-based preventive controls (proposed subpart C). Other comments do
not express this concern and note that the use of pronouns would, as we
suggested, make the regulations more clear.
    We acknowledge the potential for confusion if the phrase ``owner,
operator, or agent in charge'' applies to both plant management and
operators in proposed subpart B and to the ``owner, operator, or agent
in charge of a facility'' in proposed subpart C. Most of the provisions
of proposed subpart B do not specify the role of ``plant management''
or the ``operator'' of a plant or establishment. To prevent confusion,
we tentatively conclude it is prudent to retain terms such as ``plant
management'' and ``operator'' in proposed subpart B.
    However, we tentatively conclude that we can simplify the
regulations directed to the ``owner, operator, or agent in charge of a
facility'' in provisions in subparts C, D, and E by using pronouns,
without creating confusion, if we (1) define the term ``you'' to mean,
for purposes of part 117, the owner, operator, or agent in charge of a
facility and (2) limit use of the term ``you'' to provisions in
proposed subparts C, D, and E. See the revised regulatory text for the
definition of you (in proposed Sec.  117.3) and its use throughout
revised subpart C.
3. Proposed Definition of ``Significant Hazard''
    As discussed in section IX.C, we are proposing to delete the
proposed definition ``hazard reasonably likely to occur'' and instead
establish a definition for ``significant hazard.'' See the revised
regulatory text in proposed Sec.  117.3.
4. Proposed Definition of ``Known or Reasonably Foreseeable Hazard''
    As discussed in section IX.C, we are proposing to delete the
proposed definition ``reasonably foreseeable hazard'' and instead
establish a definition for ``known or reasonably foreseeable hazard.''
See the revised regulatory text in proposed Sec.  117.3.
5. Potential Definitions of ``Qualified Auditor,'' ``Receiving
Facility,'' and ``Supplier''
    As discussed in section XI.C, we are providing an opportunity for
public comment on potential requirements for a supplier program. If
such requirements are included in a final rule, we would establish
definitions for three terms used in the potential requirements for a
supplier program--i.e., ``qualified auditor,'' ``receiving facility,''
and ``supplier.'' See the proposed regulatory text in proposed Sec.
117.3.

B. Proposed Revisions to Definitions

    In the 2013 proposed preventive controls rule, we proposed to:
    Delete the definition of the term ``shall'' from the existing CGMP
regulations;
    Revise the definitions of several other terms in the existing CGMP
regulations;
    Retain the definitions of several other terms in the existing CGMP
regulations, with no changes; and
    Establish several new definitions.
    We received comment on many of these proposed definitions. Taking
into account the comments we have reviewed so far, we are proposing to
revise the definitions for three of these terms.
1. Revised Definition of ``Cross-contact''
    We proposed to define the term ``cross-contact'' to mean the
unintentional incorporation of a food

allergen into a food. Some comments recommend that we define the term
to be ``allergen cross-contact'' rather than ``cross-contact'' to
reduce the potential for confusion with the term ``cross-
contamination.'' We tentatively conclude that the term ``allergen
cross-contact'' may reduce the potential for confusion with the term
``cross-contamination'' and are proposing to establish a definition for
the term ``allergen cross-contact'' rather than the term ``cross-
contact.''
2. Revised Definition of ``Hazard'' and ``Reasonably Foreseeable
Hazard''
    Some comments recommend that we include radiological hazards as a
subset of chemical hazards in the definition ``hazard.'' Although
radiological hazards would not be common, we believe that facilities in
the past have considered them as chemical hazards when conducting a
hazard analysis for the development of HACCP plans. The revised
regulatory text uses the phrase ``chemical (including radiological) ''
in the definition of ``hazard'' and as applicable throughout the
regulations. As a conforming change, we are proposing to revise the
definition of ``reasonably foreseeable hazard'' to mean a potential
biological, chemical (including radiological), or physical hazard that
may be associated with the facility or the food.
3. Revised Definition of Environmental Pathogen
    We proposed to define the term ``environmental pathogen'' to mean a
microorganism that is of public health significance and is capable of
surviving and persisting within the manufacturing, processing, packing,
or holding environment. We identified Salmonella spp. and Listeria
monocytogenes as examples of environmental pathogens. Some comments
express concern that our proposed definition of ``environmental
pathogen'' would capture organisms such as pathogenic sporeformers
whose presence in and of itself would not constitute a risk to public
health.
    We are proposing to revise the definition of an environmental
pathogen to mean a pathogen capable of surviving and persisting within
the manufacturing, processing, packing, or holding environment such
that food may be contaminated and may result in foodborne illness if
that food is consumed without treatment to significantly minimize the
environmental pathogen. The revised definition of ``environmental
pathogen'' would specify that an environmental pathogen does not
include the spores of pathogenic sporeformers and, thus, recognizes
that consumption of food contaminated by the spores of a pathogenic
sporeformer that is in the environment may not result in foodborne
illness. For example, if food is contaminated with spores of
Clostridium botulinum, the microorganism would not produce the
botulinum toxin that causes illness unless these spores are subject to
conditions that allow them to germinate into vegetative cells that
produce the toxin. Pathogenic sporeformers are normally present in
foods, and unless the foods are subjected to conditions that allow
multiplication, they present minimal risk of causing illness.

C. Proposed Editorial Changes

    The revised regulatory text includes several changes that we are
making to make the requirements more clear and improve readability. We
summarize the principal editorial changes in Table 8.

                                       Table 8--Proposed Editorial Changes
----------------------------------------------------------------------------------------------------------------
     Designation in the revised
regulatory text  (Proposed Sec.   )            Proposed revision                         Explanation
----------------------------------------------------------------------------------------------------------------
Throughout part 117................  Substitute the term ``adequate'' for   For the purposes of part 117, there
                                      the term ``sufficient''.               is no meaningful difference between
                                                                             ``adequate'' and ``sufficient.'' We
                                                                             proposed to retain the definition
                                                                             of ``adequate'' that is in the
                                                                             existing CGMP requirements in
                                                                             current part 110, but did not
                                                                             propose to define ``sufficient.''
                                                                             We tentatively conclude that the
                                                                             regulations will be clearer if we
                                                                             use the single term ``adequate''
                                                                             throughout the regulations.
Throughout subparts C, D, and E....  Substitute the defined term ``you''    Improve clarity and readability.
                                      for ``owner, operator, or agent in
                                      charge of a facility''.
117.126(c), 117.170(a)(4),           Re-phrase the proposed requirements    Improve clarity and readability.
 117.170(a)(5), 117.170(d).           in active voice.
117.126(d).........................  Specify that the food safety plan is   Distinguish the requirements for the
                                      a record that is subject to the        contents of the food safety plan
                                      requirements of subpart F within the   from implementation records, which
                                      requirements for the food safety       continue to be listed in Sec.
                                      plan (Sec.   117.126) rather than      117.190.
                                      together with the requirements for
                                      other records required by the rule
                                      (Sec.   117.190).
117.130(b)(1) and (b)(2)...........  Switch the order of paragraphs (b)(1)  We tentatively conclude that it is
                                      and (b)(2) compared to the order in    more logical to specify what
                                      the 2013 proposed preventive           hazards must be considered (i.e.,
                                      controls rule.                         biological, chemical (including
                                                                             radiological), and physical) before
                                                                             specifying the reasons for how the
                                                                             hazards could get into the food
                                                                             products (i.e., naturally
                                                                             occurring, unintentionally
                                                                             introduced, or intentionally
                                                                             introduced for purposes of economic
                                                                             gain).
117.135............................  Shorten the title from ``Preventive    Simplify the presentation of the
                                      controls for hazards that are          requirements and conform with the
                                      reasonably likely to occur'' to        proposed deletion of the term
                                      ``Preventive Controls''.               ``hazards that are reasonably
                                                                             likely to occur''.

117.135(c)(1)......................  Rearrange the requirements for (1)     It is more logical to place these
                                      parameters associated with the         requirements with process controls
                                      control of the hazard and (2) the      since their parameters and their
                                      maximum or minimum value, or           values are associated with process
                                      combination of values, to which any    controls.
                                      biological, chemical, or physical
                                      parameter must be controlled to be
                                      associated with process controls
                                      rather than be a standalone
                                      requirement.
117.135(c)(3) and 117.150(c).......  Move requirements for corrections for  Improve clarity and readability.
                                      sanitation controls from the
                                      requirements for preventive controls
                                      (proposed Sec.   117.135) to the
                                      requirements for corrective actions
                                      (proposed Sec.   117.150).
117.137............................  Shorten the title from ``Recall plan   Simplify the presentation of the
                                      for hazards that are reasonably        requirements and conform with the