Many food processors ask how long can they leave RTE foods out of cold holding to perform further preparations or packaging?

Here is the answer from FDA.  Note that column 2 says “internal temperature” and not ambient (processing room) temperature.

I made what I think is a correction to the FDA data on Raw > 50F (2nd row).  The original FDA reference lists > 70F.  That seems to be an error to me.  I sent a FDA TAN request to see what FDA thinks.

Here is the standard validation support for a USDA food (and HACCP plan).  Be sure and cite this Tomkin paper and place a copy in your HACCP validation file (required by USDA FSIS).

Download (PDF, 137KB)

Generally, if a commissary is stand-alone and functions as a manufacturer and supplier of foods to its satellites, then it must comply with FSMA PC (assuming gross sales > 1 million/yr). If a commissary is part of a restaurant or grocery store and makes less than 50% of the foods sold, then it may be exempt from FSMA PC. See FDA flow chart guide below or get a copy directly from the FDA.

The concepts of verification and validation leave most beginner food safety professionals confused.  On top of that there are two different aspects to verification and validation.  The first is related to specific food safety procedures (CCPs, GMPs, SOPs, etc) and the second is a global view.  Is the entire food safety system working?


•    Monitoring: Are the operations being done as intended? (present)
•    Verification: Was the work done according to the food safety plan? (past)
•    Validation: Are the plan criteria (e.g. critical limits) based on science?


•    Monitoring: Is the entire operation being observed and assessed? (present)
•    Verification: Is all of the work done according to the food safety plan? (past)
•    Validation: Is the plan as a whole effective? (past and future)

FSMA Preventive Controls requires that Process Control CCP critical limits be validated by referencing the science or safe harbor (federal performance standard).  No other Preventive Control programs REQUIRE validation.  This includes allergens.  The FDA has not set threshold levels of allergen residuals.  On the global level, FSMA PC requires an effectiveness check (a) at the documentation stage, (b) just after the roll-out stage, and then (c) every three years.

Opposite to FSMA PC, most GFSI schema based on ISO 22000 and PAS 220 standards require formal validation of CCPs and operational prerequisite programs (oPRPs). In addition, cleaning and sanitizing programs must also be validated. Organizations must properly design, document, implement and maintain prerequisite programs, even if the standard does not specify a validation requirement for this part of the food safety system.

Process Validation focuses on the collection and evaluation of scientific, technical and observational information to determine whether control measures are capable of achieving their specified purpose (outcome or target) in terms of hazard control. Global Validation involves measuring an entire system’s performance against a desired food safety outcome.

December 2017

Disclaimer:  This is a best effort interpretation of FDA FSMA rules and guidance.  This information should not substitute for competent legal counsel.  Please report factual errors and instances where FDA is interpreting this differently.  I will update this note.   

As a brand-owner, what part of the new FSMA regulations (mostly Preventive Controls for Human Foods) must I be in compliance with?  That is a great, straightforward question.  However, like all governmental regulation questions, the answer is not straightforward.

We start with the fact that only those facilities that are required to register as a food facility must be in compliance with FSMA rules.  FDA says that if you are the owner, operator, or agent in charge of either a domestic or foreign facility that is engaged in manufacturing/processing, packing, or holding of food for human or animal consumption in the United States, you must register with FDA.  [21 CFR 1.226 lists exemptions from the requirement to register, such as farms and foodservice].  Therefore, if you are a brand owner of a food or beverage that is in a co-packaging arrangement, then the co-packer is the manufacturer and packager of the food.

Caveats.  As a brand owner, what is the level of involvement in the co-manufacturing/packaging arrangement? Do you get directly involved in any aspect of the purchasing, processing, packaging, holding of food arrangement? If yes, then you are required to register as a food facility and be in compliance to relevant parts of the FSMA rules. One less than obvious involvement is labeling.  If the brand owner applies labels or stickers to the food container, the FDA has said that is “manufacturing” (1).

Do you require specific suppliers’ ingredients be purchased for your product(s)? Or, do you buy the ingredients for delivery to the co-packer? If yes, then you may need to apply “Supplier Preventive Controls” regarding purchasing. If the ingredient would require a Supplier Preventive Control by the food manufacturer (your co-packer), then you must ensure that the same control is applied (whether by you or by the co-packer as a contractual agreement).

Do you provide labels or labeling instructions to the co-manufacturer?  In a similar manner to the above question, if you are in control of any part of the labeling process, then you must have (or you ensure the co-packer has) a food safety plan covering those controls.  Or, you can arrange by contract to have your co-packer ensure controls are in place.  Keep in mind that business contracts will dictate who pays for a recall if there ever is a need for one.  At the very least, a brand owner should verify food safety controls, especially those that could lead to foodborne illness or recall$$.

(from FDA) May 16, 2018

A new section of the FDA Data Dashboard has been launched to help importers and manufacturers/processors meet supply-chain requirements under the FDA Food Safety Modernization Act (FSMA) by helping them more easily find compliance and enforcement information related to specific firms. Three of the FSMA rules contain supply-chain requirements: the Foreign Supplier Verification Programs rule, the Preventive Controls for Human Food rule, and Preventive Controls for Animal Food rule.

The Foreign Supplier Verification Programs rule requires importers to perform risk-based activities to verify that their suppliers are meeting applicable U.S. food safety standards. One such activity is an evaluation of a supplier’s performance and the risk associated with the food, a process that includes evaluating a supplier’s compliance with FDA regulations such as whether the supplier is subject to an FDA warning letter, import alert, or other FDA compliance action related to food safety. The Preventive Controls rules require manufacturers/processors to perform supplier approval if the ingredient supplied contains a hazard requiring a supply-chain applied control. Supplier approval includes consideration of the supplier’s compliance with food safety laws and regulations.

To assist with the evaluation process, FDA created a Supplier Evaluation Resources page to help importers and manufacturers/processors find relevant compliance and enforcement information for their suppliers, but that page required them to search multiple data bases.

The FDA has improved the Supplier Evaluation Resources page, which is now available as a new section in FDA’s Data Dashboard. The Data Dashboard brings all the information from the Supplier Evaluation Resource page together, allowing importers and manufacturers/processors to search multiple data bases at the same time. The dashboard can be used to find information regarding warning letters, import refusal, import alerts, and other firm-specific information with one search.

The FDA Data Dashboard was launched in 2014 to provide stakeholders with information on FDA’s compliance, inspection, and recall activities in an easy-to-read graphical format. The expansion of this platform to make it easier to search for purposes of fulfilling supply-chain requirements under the FSMA rules is one way FDA is working to help industry comply with the new food safety standards.