FSMA Compliance Builder Questions

I am super confused on how preventive controls compares to HACCP control points.  I work at a small candy company and am trying to use the FSP Builder from the FDA to convert our HACCP plans into FSMA compliant Food Safety Plans.

We make a very low risk product.  Our candy HACCP plan has no CCP and just a few control points.  Almost all of the control points in  the process except for the cook step are contained within the pre-requisite programs of Allergen Program, Sanitation Program, Pest Program, etc. 

1.  For each step where a hazard is known or foreseeably known, how do I determine if it rises to the level where a preventive control is REQUIRED? 

2.  Also, if the preventive control is NOT REQUIRED, then do I still have to write out a complete hazard analysis in the software as if a preventive control is required to show verification, validation, and monitoring/limits that the control is effective?  Which in my case is the verification/validations I do of the Allergen and Sanitation Program on a regular basis.

3.  Anyone willing to take a look at the HACCP plan to see what needs to be updated for FSMA compliance?

i've never tried to use their software.   I think I looked at it a long time ago and gave up.  

In simple terms, you cant use your allergen and sanitation prerequisite programs in place of a control in fsma.

1.  most people use a risk / severity matrix.  you need to be able to justify your decision. somehow based on probability and severity.   however, you cant risk asses a allergen way.    

2.  You need to have a completed HA, but if there is no PC you don't need to complete verification, validations, etc.  If you have an allergen PC, then you are required (for FSMA) to have verification procedures, but not validation.      

3.  Yes, Ill look at if you like.    

So your food safety plan needs to be written by a Preventive Controls Qualified Individual (PCQI). You can qualify as a PCQI per the regulation through a standardized training program or job experience. 

To answer your questions:

1.  For each step where a hazard is known or foreseeably known, how do I determine if it rises to the level where a preventive control is REQUIRED?

Think of it in terms of what would happen if something was not monitored. For example, many companies do a label check or have a vision system for their final packaging to ensure that there is not a mispack and undeclared allergen risk. This prevents an operator from putting incorrect packaging on the line. If there was no check, no monitoring documentation - how would you know that it was packaged correctly? How would you catch the mistake before it left your facility? Since this is critical for allergen control it is an allergen preventive control. 

2. Also, if the preventive control is NOT REQUIRED, then do I still have do write out a complete hazard analysis in the software as if a preventive control is required to show verification, validation, and monitoring/limits that the control is effective?  Which in my case is the verification/validations I do of the Allergen and Sanitation Program on a regular basis.

If a preventive control is not required, you MUST show your hazard analysis. This shows that you considered all your risks and justified why they did or did not need a preventive control. 

3. Anyone willing to take a look at the HACCP plan to see what needs to be updated for FSMA compliance?

Happy to look at your current plan. Feel free to reach out!