Monday morning a FDA Investigator showed up at my firm to conduct a FSMA Compliance Audit.
Apparently they are reaching into the bucket and drawing names of companies to inspect. Our company does bread/rolls and cookies. The inspector intimated that the reason we were chosen was not because we are a "high risk" facility, but because we have a decent amount of allergens in the facility.
This was an actual FDA guy, not the contracted state officials. The audit was scheduled for 4 days.
This was not a FDA swoop in for massive swab taking. It was an audit to determine compliance to FSMA. Their stated goal is to "Educate while Regulating".
Of course, if he found something egregious in the process(s), the audit would have taken on a different light.
He reviewed our Food Safety Plans, Recall Plan, sanitation programs, allergen programs, training, supplier verification, approval and monitoring plans, and associated procedures and monitoring records. He collected production records from one specific item. He did his own hazard analysis of ingredients in that product and compared it to my hazard analysis for the same ingredients and accepted by HA, RA and any controls.
He accepted my hazard analysis and determination of Preventive Controls for the process, with a few questions about how I came to the conclusions I did.
He was impressed that I was ahead of the curve in doing vulnerability assessments of ingredients for intentional adulteration/economically motivated adulteration.
He spent probably 8 hours on the floor, observing the process, people and material condition of the facility (we have a total of 6 lines under one roof).
The wrap up meeting is in the morning tomorrow, but there were only a couple of minor findings, which are simple additions to verbiage to a couple of our policies.
Recommendations:
Use the FDA guidance documents. If you are doing hazard analysis of ingredients based upon what they have published, you should be good.
FDA is not likely to accept supplier guarantees or COA's as a PC for things like allergens or biological hazard controls.
For allergens, if you can get documentation from your supplier that specifically shows how they control allergens in their facilities, that's a plus.
For things in bakeries, where they may want to see validation of a "kill step", use the AIB Kill Step Calculator. We did this for the bun/roll line, but had not yet done it for the cookie lines.
All in all, a fine audit. We learned what the FDA is looking for, and the inspector was not looking to hammer us, but to explain the guidance documents and how FDA is using them. They realize that industry has questions, and FSMA is a large undertaking. They are learning from us as they do these inspections.
This part can be edited out by Simon or Charles if I am sounding like I am endorsing a sponsor of this forum.
This facility uses SafeFood 360. The Inspector was highly complementary of the "software", in that it allowed me to access policies, documents and records quickly and without having to resort to consulting binders of paper (for the most part).
The Inspector made the offhand comment to the Plant Manager that the QA Manager and I should get a raise for our efforts to comply with the regulation and pare down the scheduled 4 day audit to 3 days, even with a lot of chit chat during the desk audit portion. 
Marshall
