A large number of food companies in the U.S. must comply with the Food Safety Modernization Act (FSMA). Many of these companies are also certified by a food safety scheme (e.g., SQF, FSSC 22000, IFS, BRC) under the Global Food Safety Initiative (GFSI). While compliance with the FSMA rules is a regulatory requirement, GFSI is voluntary. However, certification to a GFSI-recognized scheme has significant benefits, including enhancing business prospects, promoting effective food safety efforts throughout a facility, and meeting supply chain requirements.
On the surface, managing both sets of requirements may seem complex. However, by design, there is a significant overlap between GFSI and FSMA, which helps to simplify compliance. Understanding the similarities and differences between FSMA and GFSI demands in-depth knowledge of both to successfully manage all the requirements, which is precisely where this guide comes in.
In this article, we’ll cover:
- Similarities and differences between FSMA and GFSI
- GFSI conformance to FSMA requirements
- Is GFSI the same as SQF
- Is GFSI the same as BRC
- How FSMA is addressed in GFSI audits
- How to align compliance with certification
- How findings are presented at closing meetings and in reports
First, let’s begin with a brief overview of FSMA versus GFSI, starting with a breakdown of GFSI schemes.
Aligning FSMA with GFSI Requirements
What Is GFSI in the Food Industry?
In 2000, the Food Marketing Institute created the Global Food Safety Initiative. It is not a government entity nor mandate but instead consists of the CEOs of many global companies. In the face of the increasing globalization of the food industry and supply chain, the lack of international standards was resulting in expensive and time-consuming redundancies and regulatory confusion. At the Consumer Goods Forum, leadership determined that developing benchmarks could help to drive efficiency and safety by allowing market flexibility while also standardizing key elements. Benchmarking provides a framework of comparison for various certification programs.
What Are GFSI Requirements?
As mentioned above, GFSI itself is not a certifying body but rather provides the benchmarks upon which certifying bodies base certification. To achieve GFSI certification, facilities must meet standards for organizing a quality management system with clear records, programs, standard operating procedures (SOPs), and policies.
GFSI certification helps drive consistency and trust on a global scale. Another benefit is reducing the frequency and expense of audits, foodborne illnesses, and product recalls.
Is GFSI the same as SQF?
The Safe Quality Food (SQF) Program is a food safety certification program aligned with and recognized by GFSI benchmarks. SQF offers several programs for code adherence and a path to certification based on the size, scope, and needs of the organization:
- SQF Fundamentals: designed for small to medium-sized food suppliers, this is an entry-level style program designed to assist organizations with implementing a food safety program or rounding out an existing program.
- SQF Food Safety: Food safety codes based on hazard analysis and critical control points (HAACP) help organizations meet their suppliers’ and retailers’ GFSI certifications.
- SQF Quality: For sites that have already developed and implemented a successful food safety program, SQF Quality allows them to go beyond to control threats to food quality.
- SQFI Select Site: Generally, sites are required to have audits every three years for certification, but sites can elect to submit to yearly unannounced re-certification audits.
Is GFSI the same as BRC?
Founded in 1996, the British Retail Consortium, also known as BRCGS, predates GFSI by a few years. Nevertheless, as the first standard to be GFSI-benchmarked, BRC provides globally-recognized and GFSI-recognized standards for food safety and certification. In 2019, BRC introduced the latest standard for food safety, version 8. While BRC and SQF both meet GFSI benchmarks, they differ in key details such as:
- Export needs
- Length and frequency of audits
- Unannounced audits
- Greater focus on safety vs. quality
- Voluntary modules and bundled requirements
It’s crucial that organizations examine which programs best fit their needs while also driving governmental and regulatory compliance, such as FSMA.
FSMA vs. GFSI
There are a few key areas of overlap between FSMA and GFSI. For instance, both may be customer-driven, as either FSMA compliance or GFSI certification could be a requirement for doing business. They are also similar in their approach to food safety responsibility and control of the supply chain.
The most notable difference is that the Food and Drug Administration (FDA) legally requires FSMA compliance for all businesses under its criteria, whereas GFSI is voluntary. Correspondingly, the FDA has the authority to issue mandated recalls of products, while GFSI cannot.
FSMA violations are made public under the Freedom of Information Act (FOIA) and could result in criminal charges. With GFSI, non-conformities can result in a suspension of certification. While the implications of an FSMA violation are in many ways more severe than a GFSI non-conformance, failure to satisfy the requirements of either program could ultimately result in food safety risks and loss of business.
The “FSMA Effect”
FSMA applies to producers, manufacturers, and importers of food-grade products in the U.S. However, its impact has global ramifications since it applies to many companies exporting food to the U.S. The overarching objective of FSMA is to enforce the management of complete supply-chain food safety through risk-based preventive controls.
In the coming section, we’ll explore FSMA in greater detail.
A Brief Look into FSMA Rules
Several rules and requirements comprise FSMA, including the following:
- Section 117 current Good Manufacturing Practices (cGMPs)
- Preventive Controls Qualified Individuals (PCQIs)
- Preventive controls and process controls Supply chain management
- Recall program and traceability
- Hazard Analysis and Preventive Controls (HACCP)
- Recordkeeping, monitoring, and corrective actions
- Food safety plan and records
The Issues & Impacts of FSMA
Pursuing and maintaining FSMA compliance is a broad and complex endeavor. Organizations must satisfy many details. On a basic level, impacted companies must:
- Determine and document which aspects of the regulations apply to their facilities
- Establish what does not apply and record this information, as well
- Document the justification of applicable programs
- Establish and maintain a current food safety plan, which is the backbone for FSMA compliance
Next, let’s review how some FSMA rules can align with a GFSI program.
FSMA & GFSI Considerations
With all its rules and requirements, FSMA is robust. Yet, GFSI has its own broad range of elements developed to consistently drive quality and safety. Fortunately, compliance with FSMA’s regulatory requirements does align to meet many of GFSI’s certification requirements—and vice versa.
It is essential to create alignment among your facility’s FSMA and GFSI compliance efforts. Here are some factors to bear in mind:
- Both FSMA and GFSI require qualified individuals, including food safety team leads or coordinators.
- Your facility’s hazard analysis should be aligned to address preventive controls.
- The GFSI Supplier Program addresses supplier verification, supply chain management, and Food Supplier Verification Programs (FSVP) under FSMA. Supply chain management is consistent with GFSI, so the two are in close alignment in this area.
- GFSI prerequisite programs (PRPs) align with FSMA cGMPs, including:
- Environmental monitoring
- Sanitation program (validated) with qualified manager(s)
- Food fraud and food defense to mitigate risks of adulteration within the facility or supply chain
- Food Safety Management System (FSMS), including HACCP and control points/controls
- Qualified audit resources: internal and external
Creating a Strong Food Safety Plan
Organizations should include the following elements to create a solid, FSMA-compliant Food Safety Plan:
- Hazard analysis and preventive controls (performing a hazard analysis and determining preventive controls can be challenging in some facilities)
- Section 117 cGMPs
- Food safety team
- PCQIs (unless you have a very small facility, multiple PCQIs will likely be required)
- Qualified internal audit resources
- Qualified sanitation management (you may outsource this service, but document and prove that your program is effectively deployed)
- Qualified food defense and FSVP resources
With these Food Safety Plan details in mind, let’s examine additional FSMA requirements, including those surrounding PCQIs.
FSMA Requirements: Qualified Individuals
Qualified Individuals are an important part of ongoing FSMA compliance. Food processing and distributing facilities must have an established PCQI within the organization for its Food Safety Plan, as required by FSMA rules. This individual (or individuals) oversees the development of all efforts to meet related FSMA requirements at a company or site. The PCQI must maintain proper qualifications, including education and experience.
Multiple individuals should have this role and responsibility to cover food safety operations at all times. Facilities should have an established PCQI to support FSMA compliance in the following areas: audit, sanitation, food defense, and FSVP.
PCQI Qualification Requirements
Although FSMA’s PCQI qualification requirements are similar to the rules for GFSI team leaders, HACCP Coordinators, and other qualified food safety staff, they do differ in a few ways. Here is a look at what’s required for PCQIs:
- A PCQI must complete training in developing and applying risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by the FDA or be otherwise qualified through job experience to develop and apply food safety program administration.
- A PCQI may demonstrate job and industry experience in food safety, but the individual must understand FSMA law.
- One approved training method is the PCQI course, which at least 20,000 individuals have completed.
- The PCQI must have the capability to contribute to and oversee the FSMA Food Safety Plan to Section 117 requirements and dietary supplements section 111.
- A PCQI must have the capability to oversee other related FSMA rules, such as FSVP.
- FSMA requires multiple PCQIs on staff to serve as backups.
PCQI Role Validation Questions
To ensure PCQIs meet the eligibility requirements to fulfill their roles effectively, here are some PCQI role validation questions to consider:
- Have you established a program to “vet” and validate your PCQIs under FSMA and GFSI?
- Does PCQI status include the verification of full qualifications to FSMA and GFSI?
- Following accepted PCQI training, has a process been established to verify the capability of your PCQIs to GFSI scheme requirements?
- Have you qualified an audit process and trained auditors to meet the requirements of your FSMA Food Safety Plan and your GFSI scheme?
- Have you determined and documented the specific Food Safety Plan role of your PCQI, including decision-making as it relates to GFSI?
- How is internal audit and sanitation addressed to readily meet both FSMA and GFSI?
Essentially, your facility’s PCQIs should be at the same level as your GFSI team leaders.
HACCP Coordinator/PCQI Role
The HACCP Coordinator role under GFSI meets the PCQI role under FSMA. It encompasses the importance of effective recordkeeping, HACCP program verification processes and procedures, the establishment of preventive controls as part of hazard analysis, and supply chain management.
For example, even though a given facility may have preventive controls, you may also have critical control points (CCPs), such as temperature levels, critical times, and metal detection. You must have proper methods to establish critical limits, preventive measures, validation of CCPs, and monitoring requirements, which can be combined under your HACCP Coordinator in GFSI. Conveniently, GFSI provides a documented register of programs and records to meet these mutual requirements concurrently.
Now that we’ve looked at the PCQI requirements for FSMA and how they overlap with GFSI let’s dive deeper into another FSMA rule, FSVP.
Foreign Supplier Verification Program
FDA first proposed the FSVP rule in July 2013. The final rule was issued in November 2015. In addition to having a PCQI, FSMA requires an FSVP-qualified individual. To ensure compliance, this individual must know to implement the requirements of the FSVP for:
- Importers of human and animal food under FSMA regulations
- Regulation and guidance that implements the provisions of FSMA
- Overseeing U.S.-based importers who meet the definition of “importer” in the FSVP rule
There are various ways to manage the program, so the FSVP qualified individual needs to be knowledgeable about the law. GFSI addresses much of the same within their supplier qualification rules and mandates that facilities must also meet regulatory requirements.
The FSVP requires U.S. food importers to implement plans to ensure compliance of foreign suppliers to FSMA requirements, including GFSI requirements. Importers must register with the FDA to make shipments; foreign suppliers must be in good standing with the FDA. Additionally, U.S. importers must ensure foreign suppliers maintain FSMA-compliant Food Safety Plans. Foreign suppliers must also meet the food safety requirements of customer programs, including GFSI requirements.
FSMA also requires that facilities undergo audits and implement assessments to ensure all requirements are met. Verification and validation processes are required, and facilities must establish document requirements for each level in the supply chain to qualify for collaboration with foreign suppliers. The U.S. can suspend foreign suppliers for reasons such as lack of site inspection. Importers and foreign suppliers must also allow shipment inspections.
These rules represent additional supplier qualifications within GFSI that can be expanded to meet FSMA within one joint program.
We’ll look at some remaining FSMA rules and how GFSI has been updated to reflect them in the coming section.
Additional FSMA Rules
In addition to the FSMA rules covered thus far, there are additional recent developments that facilities must consider for compliance, including:
- Food defense assessment and controls were instated in 2019, with enforcement beginning in 2020.
- Intentional adulteration vulnerability and plan were also instated in 2019, with enforcement beginning in 2020. It requires companies to perform a vulnerability assessment and establish procedures to control adulteration.
- Currently, requirements for the environmental monitoring program are already in place to promote enhanced sanitation programs and a higher level of emphasis on environmental monitoring.
- Food traceability came under greater scrutiny with section 204, which mandates the FDA to designate foods that may require additional recordkeeping for supply chain transparency.
GFSI has added these rules to their most recent updates. Each GFSI scheme addresses these requirements, which can best be met with FDA-recommended tools, such as the food defense tool builder.
To support enhanced compliance with evolving FSMA rules, GFSI recently rolled out version 2020. The update reflects the latest marketplace changes, along with continued dialogue with the FDA. The newest version enforces GFSI requirements that better align with FSMA and the FDA in general.
- Streamlined language to facilitate transparency and consistency in certification programs
- Structure more closely aligned with ISO22000, with sequential numbering
- Alignment with the most recent Codex Alimentarius guidelines
- Driving transparency by moving toward mandatory unannounced audits
- Establishment of a minimum audit duration
- Emphasis on food safety culture
- Focus on hygiene from farm to fork
GFSI Conformance Requirements
Conformance with GFSI requirements will allow facilities to meet the vast majority of FSMA requirements, as GFSI conformance emphasizes:
- Management responsibility
- Internal audits (facilities must make sure programs are up-to-date and any corrective actions are being addressed)
- Sanitation (GFSI has been placing increasing emphasis on sanitation to address biological pathogens)
- Food defense and food fraud
- Supply chain controls
- Reanalysis (FSMA gives seven days to prove with records that a non-conformance has been controlled and 90 days to update the Food Safety Program; GFSI parallels this timeframe)
- Customer complaint response
- Hazard analysis, allergen programs, flow, description, and decisions
- Unannounced audits
We’ll look at how GFSI audits, and FDA FSMA inspections compare in the final segment.
FSMA Inspection Findings
GFSI and FSMA inspections are used to identify issues within specific facilities and pinpoint challenges across the industry as a whole. From 2016 to 2017, the key findings from FSMA inspections showed that lack of effective pest exclusion and sanitation monitoring continued to be the top issues for facilities throughout the U.S.
While part of the reason for these problems could be that many food buildings are dated, even newer facilities can face pest control and sanitation issues. Not surprisingly, the top audit findings from GFSI under the SQF code show similar results: key issues included cleaning and sanitation, vermin-proofing, and dust.
Documented Findings—GFSI Assesses FDA/FSMA
The GFSI scheme audit report aligns with FSMA findings in that both are used to identify and encourage the resolution of non-conformances. Auditors will also verify that the GFSI-certified company’s programs address FSMA for program updates to create overarching food safety compliance.
Minimal FSMA-Level Reporting Requirements
The minimal reporting requirements for FSMA include:
- Auditor PCQI certificate number
- Documented Food Safety Plan, overseen by the company’s PCQI
- Proof of suppliers’ FSMA compliance
- Identification of Section 117 cGMPs
- Identification of preventive controls within the Food Safety Plan
- Science-based evidence for preventive controls (as validated)
- Validation, revalidation, and verification programs
- Documented FSVP verification
Suggested Notes to GFSI Auditors
As your company considers its GFSI compliance efforts, here are some key points to think about:
- With GFSI, there is no FSMA Food Safety Plan flow diagram or decision tree required for hazard analysis. The flow description is accepted, which is one of the relatively minor differences between the two.
- There is flexibility in the use of terms.
- FSMA provides what a company must do, but not how to do what they must do.
- Preventive controls and PRPs may be elevated or reclassified.
- Companies can determine the numbering system used to meet both FSMA and GFSI.
GFSI Auditor Opening Meeting
Remember that a GFSI certification audit is not an FSMA compliance assessment. However, if non-conformances (including FDA, USDA, EPA, OSHA, or DOT) are discovered, it will impact the GFSI audit results.
FDA Closing Meeting
FDA auditors will issue the inspection findings and regulatory compliance status during closing meetings. They’ll also present evidence to support their findings and describe the classification of non-conformance to the specific standard. GFSI inspection findings may also identify possible FSMA non-compliances. Similarly, FDA closing meetings may include an assessment of how the company complies with documented food safety programs, including GFSI, if applicable.
The FDA closing meeting can include form 482d, which is the notice of inspection report, along with 483a, an observation report that could encompass voluntary responses or consequences, depending on its contents.
Sign Me Up
Join our list to get Industry Webinars Invites, E-Guides, Customer Success Stories, and More.