The most sweeping set of food safety reforms of our lifetime was signed into law by President Obama in January 2011. Called the FDA Food Safety Modernization Act (FSMA), the Food and Drug Administration is now writing proposed regulations that will likely take effect next year. What do dairy companies need to do to get ready? Here are four critical areas for you to focus on now.

It’s all about prevention

The guiding principle behind FSMA is that the food safety system—as instituted by the food industry and overseen by the FDA—should be based on prevention. Enactment of the law followed a series of foodborne illness outbreaks, and Congress decided it would be better to prevent food safety problems from occurring, rather than reacting to outbreaks and recalls after the fact.

To achieve this goal, FSMA requires each dairy facility to have a food safety plan. Based on well-known HACCP (Hazard Analysis and Critical Control Points) principles, each dairy company will soon be required to conduct a detailed analysis of the reasonably foreseeable hazards present in each facility and then design and implement preventive controls to significantly minimize those hazards.

Many food companies have implemented HACCP in their facilities for years, and those companies should simply review their HACCP plans and tweak them as needed to meet the new law’s requirements. This means making sure the plan addresses all the potential hazards listed in the law, as well as ensuring there is scientific validation that each set of controls is indeed effective. These steps can all be undertaken now.

Other steps will need to await FDA’s regulations; particularly the scope and extent of testing FDA will want to see. FSMA envisions a robust set of verification activities to be sure the controls in the food safety plan are effective. These activities are to include product and environmental testing, but the jury is still out on the scope and extent needed.

Oversight of suppliers will be in the spotlight

The prevention theme extends not just to a dairy company’s own facilities, but to its ingredient suppliers as well. Congress recognized the fact that a single contaminated ingredient could cause the recall of literally hundreds, or in some cases, even thousands of finished products. Congress also recognized the fact that there were simply too many ingredient suppliers for the FDA to monitor all by itself, so the law places responsibility on the finished product manufacturer to do so.

Supplier verification applies to both domestic and foreign suppliers, and FDA is expected to apply comparable requirements to both. FSMA gives dairy companies some latitude to decide how, and how extensively, to oversee their suppliers. For example, dairy companies might choose to conduct an on-site inspection of the supplier, to test incoming ingredients, and/or to review the supplier’s HACCP plans. The key is that the manufacturer’s oversight needs to be sufficient to ensure the supplier is meeting the same food safety requirements as the manufacturer.

It is expected that FDA will provide for some role, particularly for foreign suppliers, for third party certification programs, such as those benchmarked under the Global Food Safety Initiative (GFSI). The food industry has provided FDA with extensive information on such programs, and the agency appears to recognize this could be a feasible way for medium and smaller food companies to oversee foreign suppliers. Stay tuned for more details, but start preparing by taking a close look at what you are doing currently.

Records access changes character of inspections

Perhaps the biggest change for food companies will be in the fundamental character of FDA on-site inspections. This is because FSMA grants FDA broad access to a company’s food safety records. Instead of an inspection focusing on what the company is doing the day of the inspection, FDA will instead try to look back—through a company’s own records—to see if the company has been operating at a high level of safety ever since the previous inspection.

What kind of records will FDA have access to? Virtually everything related to the food safety plan and its implementation. This includes: (a) the hazard analysis; (b) the system of controls and the scientific validation supporting them; (c) monitoring records; (d) verification records, including testing; and (e) corrective actions.

Accordingly, food companies should start planning now on how to develop and maintain the kinds of records that will demonstrate to the FDA inspector that the company is “in control” of its processing operations. Instead of being viewed as potentially documenting “bad news,” a company’s records can now be your best tool to show the FDA that you do a good job. The new mantra will be, “If you didn’t document it, it didn’t happen!”

And don’t forget re-registration

Starting in October of this year, all food facilities will need to re-register with the FDA via the online registration system set up under the Bioterrorism Act of 2002. Re-registration will be required every 2 years, each October, which is the beginning of FDA’s fiscal year. Since initial registration occurred nearly 10 years ago, it is a good idea for dairy companies now, especially smaller companies, to go back and refresh your memories on how to do this.

Enforcement will follow final FDA regulations

Although FSMA states the new rules will go into effect on a certain date, with or without new regulations, the agency has wisely stated it will not enforce the new requirements until final regulations are promulgated. That is expected to be sometime next year.

But it is never too soon to start. FDA’s inspections have already begun to anticipate the new requirements, and FSMA new enforcement tools, like mandatory recall and suspension of registration, are already in effect. So the time to get ready is now!