From Records to Readiness: A Practical Path to FSMA 204

[00:00:00] One thing the rule doesn't do is require end-to-end traceability that's visible to everyone in the supply chain. I think that's a misperception, but everyone's responsible for their own data and is going to be held accountable for their own records that are key data elements at each critical tracking event.

[00:00:21] Hello and welcome to the Next Level Supply Chain with GS1 US, a podcast in which we explore the mind-bending world of global supply chains, covering topics such as automation, innovation, unique identity, and more. I'm your co-host, Read. And I'm Liz. And welcome to the show. I was so lucky to have just had a great conversation with Hilary Tesmar from FMI.

[00:00:44] She and I talked about FSMA 204, the traceability rule that FDA has implemented, and we went back to basics. What organizations need to think about, who they should be involving within their four walls, how they should be talking to their trading partners, and things they can do now and should do now so that they're ready for July 20th of 2028. Hey Hilary, welcome to the show. Hi, Liz. Thanks so much for having me. It's so great being with you.

[00:01:14] So we have been talking, you and I and industry have been talking about FSMA 204 for a while. And we thought it would be good to just take a step back and have a conversation to level set what FSMA 204 is, Food Safety Modernization Act, and how it impacts industry. Because there's a lot of moving parts and I think a lot of misconceptions.

[00:01:38] You and I have worked with industry, you work really well and closely with your members, and I would just love your perspective on some of these really basic questions that will help folks figure out what FSMA is and how to get started. So first and foremost, what is FSMA 204 and what are the biggest misconceptions around it? Okay, great question, Liz. So let's go back to what FSMA is. So FSMA stands for the Food Safety Modernization Act.

[00:02:07] It was a bill that Congress passed in 2010. And President Obama at the time signed it in January of 2011. So FSMA itself has been around for, you know, 15 years or so. So FSMA 204 is the number of the section in that bill. So it is Section 204 in the FSMA Act, in the Food Safety Modernization Act.

[00:02:35] And it is one component of a number of comprehensive authorities and changes to our food safety system under FDA's authority. So FSMA changed the Food, Drug, and Cosmetic Act, which goes back almost 100 years now. It first passed in 1938. So FSMA was a major change to the Food, Drug, and Cosmetic Act. Okay, so Section 204.

[00:03:02] And there's Section 101, 102, 103. So there's a lot of sections before we get to 204. And Section 204 is about additional record-keeping authority for FDA to have to track and trace food throughout the supply chain. So that is kind of what it's all about.

[00:03:25] And what the bill or the statute said is for high-risk foods, FDA has additional authority for record-keeping. So based on that, again, 2010, 2011, we're going to fast-forward. In 2014, FDA did an advance notice of proposed rulemaking on how do you determine what is a high-risk food.

[00:03:51] So they did an ANPR on the methodology to get to that list. So now we're going to fast-forward again to September of 2020 when we first saw the proposed rule from FDA on food traceability. So that was open for notice and comment. The industry commented on it. And then we get to November of 2022 when they published the final rule.

[00:04:19] So that is what we're working with, the whole process from a bill to regulation. The final regulation was November of 2022, and it's called the FDA food traceability rule. There was another part to that question, the misconceptions. The misconceptions, but that's really helpful because I think when folks in our world, from a supply chain perspective, think about FSMA 204.

[00:04:47] They don't necessarily know that FSMA is a much broader topic. Yes, it is much broader. And it really, the whole reason for FSMA was to really focus on prevention of food-boreal illness. 204 is part of the response mechanism.

[00:05:05] So it's not preventive, but it's if something does go wrong, how do we find it faster and identify the contaminated food faster and then know the scope of that product? And that's part of the record keeping. Correct.

[00:05:21] We've talked about it before, but they have all of these different pieces and parts of critical tracking events, which are different points in the supply chain where certain data elements or key data elements, it's just information needs to be tracked. And I'm assuming the idea is, with all of that information at the ready, the idea to get back to that original food-borne issue would be more quickly uncovered.

[00:05:50] Is that kind of the premise there? That is correct. That is correct. Yeah. And the purpose of it actually came out of multiple crazy situations where it was really hard to know what product was kind of within scope of what could have been contaminated. Yeah.

[00:06:06] So going back to some of the larger outbreaks and recalls that led to FSMA, I'm thinking the spinach and E. coli outbreak, I want to say 2006, there was a tomato and pepper kind of question. And what was it, the tomatoes, which people thought first, and then was it the peppers and couldn't figure out where everything was coming from, commingling, all of that. And then another one was the peanut paste with PCA.

[00:06:34] That was also one that kind of led to this rule being in FSMA. In that case, the trace forward was very hard. The product went a number of different places and it was hard for the industry at the time to account for everywhere that went. Yeah. And I know we're all living through the cyclospora right now. And so we're, traceability is really on the front of our minds from a consumer perspective even. And then you're a business and it impacts you so much differently.

[00:07:04] Exactly. And I think it is top of mind right now. It's been a very rough summer when it comes to foodborne illness. And the traceability helps on the back end. You need a really strong epidemiological investigation to figure out what was the common element or common elements between the people who got sick and diagnosed with foodborne illness. And then traceability kicks in about midway through that process. You need that strong epi.

[00:07:34] And then with traceability, identify, okay, where did this product come from? Where did it go to? Where else did it go? That's been a big theme this summer is the points of exposure. And then we've seen expansions based on where else the product went in the supply chain. It's been crazy listening to the news and just from a supply chain perspective, especially with, I think it was peppers.

[00:07:59] And you think about how a pepper or any kind of ingredient like that is chopped up and then put into so many different things and to understand and know where that's going. And then the epi, I imagine this big puzzle, and I know that's not what it is, but putting and trying to figure out things that you don't know and you're much relying on people's memory. It's crazy. Correct. Because I mean, think about it from your point of view or our point of view.

[00:08:26] I mean, if you do get sick and are part of the investigation, they're going to ask, you know, where do you shop? What foods do you eat? Where have you gone to a restaurant? Do you remember what restaurants you've eaten in the past couple of weeks? That might be tough to pull that list together. And it's easy to forget something, you know, were you in an airport? Yes. What restaurant did you or what stand did you go to? I don't know. I just look at my calendar and see where I was. So it is very complex.

[00:08:54] And it is, I think the puzzle analogy is a good one. It is a puzzle. And it's, you know, the folks, the public health officials who are amazing and don't get the credit that they deserve. They work so hard and they're doing it really to prevent illness and to protect consumers. And it is kind of the analogy I use is they're CSI investigators. I mean, they really have to figure out and ask the right questions and kind of put everything together.

[00:09:23] And it is, there's an art and a science to it. Yes, absolutely. And hopefully, FISMA 204 will help at least that traceability part. So the rule is in effect, but it goes into compliance. And I always get this mixed up in July 20th of 2028. Is that right? Yes. So the compliance date is usually right after a rule publishes. The enforcement is what we're looking at. Yep. In July of 2028.

[00:09:50] So that sounds like a long time from now. And I think that as we've been talking to folks, they're like, yes, we know it's coming. There's different priorities we need to worry about now. So we're just going to worry about it in 2027, early 2028. Tell me why it's important to really start thinking about it now and the challenges that organizations may face. Yeah, it's a really good question. It is super important that companies start now.

[00:10:18] So we have, again, FMI is a larger trade association. We have members of all sizes and throughout the supply chain. And even the largest, most sophisticated members are really having some significant, I don't want to say challenges. It's a heavy lift. There's a lot to do to come into compliance with this regulation and to be ready for enforcement in July of 2028.

[00:10:43] So even the most sophisticated companies with significant resources are really having to do a lot of work with cross-functional teams. So it's not something that one person or even one simple project team can implement. It's going to take a long time. I mean, it's kind of like some of the initiatives at GS1 US. I mean, there are years in the planning and process and you have launch dates and it's like that.

[00:11:10] I mean, it's really, this is talking about, it's going to impact inventory systems. Warehouse management systems are, you know, a top discussion point just because they were designed to do one thing. And now they're having to do additional things based on those key data elements that FDA is requiring the industry to maintain for every single lot of food. You know, we haven't had to track lot codes.

[00:11:37] We've tracked, you know, quantities, we've tracked product information and product identifiers, you know, dates, times, addresses, all of that. That is part of the normal course of business and that's how the industry tracks product now. But now we're going to have to add a couple of key data elements to that, that we aren't tracking.

[00:11:57] And it's a lot of information, it's a lot of data, it's a lot of maintenance of data, and there's significant IT changes and enhancements that need to happen in order to get to the point where we are going to be compliant and that takes time. And such a reliance on training partners to get that information, those lot codes and those product identifiers and all of those key data elements to the folks in the supply chain that need it.

[00:12:27] And if you're receiving that information, much to what you were saying about the IT, you're not used to getting all of that additional data and what are you going to do with it? I mean, exactly. And then different kind of puzzle. Exactly. And be able to make sense of it, too. And then provide it to FDA. And FDA has asked for the industry to be able to provide an electronic sortable spreadsheet to them within 24 hours.

[00:12:53] So you have to maintain the data, but then if there is an investigation and you're asked for records, they want it in that electronic sortable spreadsheet. The reliance on the supply chain partners up and downstream is super important. So everybody's responsible for their own data at receiving through shipping. So you need that receiving, the shipping information from the previous person in the supply chain. A facility is going to maintain it as receiving records.

[00:13:23] And then if it's a transformation step in the middle, it could just be receiving and then shipping out the other end. And then you have to share that shipping information with the next step. So everyone's relying on each other. One thing the rule doesn't do is require end-to-end traceability that's visible to everyone in the supply chain. I think that's a misperception.

[00:13:48] But everyone's responsible for their own data and is going to be held accountable for their own records that are key data elements at each critical tracking event. CT. And I think you just highlighted there that you can't have conversations with all of those suppliers and customers in a fast fashion.

[00:14:10] And so if you don't start now and know what kind of information you need to send or you will be receiving, you're going to be super behind the eight ball. Because it's a lot, like Hillary said, it's a lot of different kinds of data. Some of it's super simple, right? Some of it is an address. Some of it's a date. But there's extra information that you just need to start thinking about. Okay, so you have this cross-functional team and you're starting to think about, okay, what's next?

[00:14:37] How would you advise folks to think about, okay, what your current state is for traceability, what your current, I don't know, capabilities are for scanning and identify gaps, whether electronic or physical, when it comes to like a food safety FSMA 204. Because food safety is different within organizations. Some of it's more epi and some of it's just now supply chain.

[00:15:05] But what would you tell people to like first do once you get that cross-functional team? What's the first thing they should start doing? There are a lot of tools and resources available. So that is good news for anyone just starting the process now. There's a lot of information that's already been developed by multiple associations. GS1 US has a ton of great resources on your website that we point people to.

[00:15:29] But what we recommend is doing an evaluation of a kind of a gap assessment. What can you do now? And what is different than what you're doing now? So, and one thing that our members did very early on was aligned around GS1 US standards, product identification standards, and event data standards. As the foundation.

[00:15:55] And we mapped the KDE's, the key data elements to the GS1 standards. And there are standards that fit for everything. Sometimes it's a combination of two standards. Like, for example, the traceability lock code. That's an example where we had to combine two data standards to get what we needed.

[00:16:15] But most of them are elements that the industry is very familiar with, uses on a regular basis, and can easily use with our existing systems with some enhancements. And I would say you also have really great resources, one of which is a questionnaire for organizations to start thinking about when it comes to needing a new solution provider or not.

[00:16:45] I think there's a lot of misconception of what is needed versus what isn't needed. And the questions that you all have out there is just a really black and white way to understand this is what you should be thinking about when you're assessing a need for something technology driven. Yeah. I mean, a lot of our members started asking us pretty early on, you know, who do you recommend?

[00:17:09] And we didn't feel like we were even closely capable of being able to do that. So what we did instead of vetting suppliers, which we don't do for our members, it's just not something trade associations do. So what we did is we developed with the collaboration of several partners at GS1USB, one of them, we developed a list of questions to think about when you're vetting suppliers.

[00:17:37] So we've heard that it's really helpful for our members to kind of, you know, know what to ask and what to think. We didn't even say what the right answer was. We just said, these are the things you should be talking to that solution provider about. And it's worked. There has been a lot of innovation in this space. There are a lot of solution providers. There are more now than there were three and a half years ago. But we find that, you know, each member is going to have different needs. Each company is going to have different needs.

[00:18:07] And they can kind of match what their needs are to the right partner for them. I think it's great. We're neutral, as y'all are in this. And it just gave everybody kind of a starting point of things to start asking themselves. So the gaps and the tools, what should organizations really prioritize at that? Like, okay, you've got your team, you've got your gaps. How then do you implement?

[00:18:37] And I think that's where a lot of companies are right now. From where I am and what I'm hearing from our members is they've done outreach to suppliers. They've said to suppliers, this is what we expect. There's a couple of steps in that process. We need to start testing the system. So they spend a lot of time developing their systems, enhancing their WMS system or, you know, their IT infrastructure. And so how do we start testing?

[00:19:05] One of the huge challenges with this rule is scale. You know, the pilots have been one product, one facility. So how do we go beyond that? So one of the things our members have said when we're talking best practices, you know, start small. Don't just turn it on for everything at once. Start with a few suppliers who are kind of in front of the curve and ready to start sending some information. Start there and start testing it.

[00:19:34] You know, maybe pick a few product categories, you know, for the retailers and wholesalers. What product categories are you frequently asked for records? Or, you know, after this summer, we could say produce. But, you know, specifically, let's even start with a narrower category. Let's start with fresh cut leafy greens. Let's start small and then build. And it could be anything. You could start with seafood if that system is more built out. They've done a lot of work on traceability.

[00:20:03] You could start with anything that's on the food traceability list. But just don't expect perfection if you just turn on the system for everything at once. And I think that's one of the challenges, too, in the time that's needed in order to get to the enforcement date in July of 2028. We need to build. And the enforcement date applies to all foods on the food traceability list on the same day for the entire supply chain.

[00:20:31] So we need to break that down into smaller pieces that are manageable and we can kind of test some things early on, make some changes if necessary. Or if everything's working, then let's just expand it. Let's expand out the group that were receiving the record. But the companies are receiving records throughout the supply chain. We'd have to have one forward and one back traceability since the bioterrorism roll in 2002. So we have that.

[00:20:59] That rule didn't tell you what records to keep and what data elements. So that's what's new about the FISMA traceability rule is FDA is now saying you have to keep this specific information. We don't care what you use to keep that information as long as you can get to us in 24 hours in an electronic sort of spreadsheet. So that's the change. There's so much to it. And we're actually working on a pilot right now around the data that's coming in to distributors.

[00:21:29] And when you talk about having those conversations and biting off little chunks, basically, the data quality is it's just not there. No fault of anybody's, but they haven't needed to keep this kind of information and send it in a thoughtful way before.

[00:21:50] So that takes for any of us who have been in industry takes a long time and lots of resources internally to do something that's I love data quality conversations. But not everybody does because it's just right. It's just has to be OK. It's not super exciting. But I think I wanted to ask you about the folks that you work with that are kind of I don't want to say ready because I'm not sure that anybody is ready ready.

[00:22:16] But throughout the different stages of readiness, is there any best practices that you can call out from somebody who's a little bit further along in their implementation? And I think a lot of companies are at that point. They've they've done pilots. They've started asking for data from their suppliers. They know what the easy things are and they know what the gaps are. I think to me, one of the things that we've been trying to talk to our members about, there are always going to be exceptions.

[00:22:45] The supply chain is complex and convoluted. And there are a lot of things that could go wrong. What we've been focusing on is let's work on things that move through the supply chain in the normal ways without the exceptions. And let's get that covered. And then we've spent a lot of time going down rabbit holes on what ifs.

[00:23:07] And I think a best practice is let's focus on the normal practices and get most of the products traced under the regulations of the food traceability rule. And then let's worry about the what ifs, the door to store transfers, the reclamation. Yes, we need to think about that because it's within the scope of the regulation.

[00:23:30] But it's more important that we get 80, 90 percent of the products covered without those exceptions that will happen. And the complex situations that are going to take a lot more time and effort and kind of engineering to figure out how that's going to work, especially in a cost effective way. Absolutely. So, yeah. So I think my recommendation for best practices work on the stuff that moves through the supply chain in the normal way.

[00:24:00] Work on the normal process flow. This is a challenging role for everybody to implement. We're seeing a lack of awareness as we go deeper in the supply chain. So, you know, the people supplying directly to our members, product suppliers, retail, wholesale are aware of it. And they're at different points of readiness. But a lot of small and medium companies don't even have that awareness.

[00:24:27] And then when you go back to the ingredient level, it's even harder. So I think that's also a challenge. So I think start with your suppliers that are aware and have been working on it and are ready and, you know, just test sending information. And if it's not perfect, I mean, that's OK right now. The data quality piece is a really challenging one. And I think that actually brings in a different type of expert that needs to be part of the team.

[00:24:55] The data management folks, the master data management, you know, project managers and experts, data analysts, they're super important to this. And we're going to need their assistance on how do we continually increase the quality of the data and where are the problems? What needs to be fixed? You know, I think continuous improvement is going to be a super important theme moving forward. We're not perfect now. We probably won't be perfect on, you know, July 20th of 2028.

[00:25:24] But as long as we're still implementing and working towards improving to get closer to what FDA requires, I think that will be recognized. I love what you said about taking it kind of piece by piece and not all at one time, focusing on the big things. Because you and I have been in so many conversations when those rabbit holes just take up the entire conversation. We're not solving the big problems, the big category of whatever that needs to be identified.

[00:25:53] And I think that to get started, you really have to put on that hat of we're going to do this now and worry about that later. Exactly. There's always exceptions, no matter what. There's always exceptions. I do think, and one of the first things that Hillary, you and I worked on years ago with this, I remember is there was a slide that has all of the different pieces of the puzzle within organizations.

[00:26:17] You're going to have regulatory, legal, scientific affairs dependent on, you know, recipes, things like that. Master data, supply chain. I mean, there's so many, and we mentioned this earlier. It's a whole different beast. Also, another point that I love that I just have to point back out is that forward progress, baby steps, because perfection won't, there's no way it'll be perfect July 20th of 2028.

[00:26:44] And we continue hearing, at least we do from FDA, that progress over perfection, you start making progress now. It does take a while to move that ship. And I think FDA's already seen that with some of the outbreak investigations over the past couple of years. They've had more data than they had in the past, and they've acknowledged that.

[00:27:07] And FDA actually did, as part of the appropriations bill that passed in November, FDA was basically required by Congress to do a couple of different elements. And one of them was to do roundtable or tabletop exercises. And FDA published that report.

[00:27:25] It was either in late May or early June that they published that report, but they acknowledged in that report that having some records helped them, even though no one who participated was compliant at the time, it still was progress forward that assisted the testing that they did in the tabletops. So that's a huge part of it. And companies should work forward towards that slow incremental progress.

[00:27:52] And given we're still just under two years out, there's time to do that. But companies need to start planning now. Absolutely. And like you said, there's a ton of resources. Don't reinvent the wheel. We're each part of associations. We're happy to help. Don't start from scratch. We're happy to help. So if we look, you know, we've talked about compliance and you've talked about domain analysis systems, master data. If you're looking beyond compliance, you have to do this.

[00:28:22] You have to check the box. What else are organizations potentially going to benefit from? So you have to do this for compliance. Where else is there ROI that you've been hearing? I think there's some great case studies that throw that, that demonstrate that. I mean, both of us have been working on traceability back to the PTI days and the IFT, you know, report that came out.

[00:28:46] And there are some great case studies, you know, even 15 years ago on the increased benefits from having the business records, labor savings, you know, what employees were working on or how many cases they made, that kind of thing. So there's quite a bit of efficiencies that could be captured with the additional data. So I do, I think companies need to look at how can this data benefit me?

[00:29:15] Does it help with our invoicing? Does it help with returns? Does it, you know, there's all kinds of things that could be more transparent with this kind of data being shared throughout the supply chain, partner to partner.

[00:29:30] So I do think there's kind of a strategic leadership component to this, that companies can take advantage of having more information, you know, for saving costs, but also increased transparency of the supply chain, which is another huge initiative that we could talk about. Yes. But so there's a lot of different ways to do it, but there are a number of case studies that are available on the benefits of traceability and increased record keeping.

[00:29:59] I don't want to minimize the complexity of what compliance looks like. So there's a heavy lift. There's a lot of capital expenses, but companies can definitely take advantage of the additional information that they're gathering. Yeah. Just have to be a little creative maybe. And I don't know that that's easy to do when you have a compliance state looming two years out. Exactly. And that's why the team is so important. You know, bring people in and there isn't a formula for the team.

[00:30:28] You know, it's not the same. Every single company is going to have a different team working on compliance and implementation. And it depends on where you are in the supply chain. It depends on, you know, your resources. It depends on your company culture. There's a lot of different factors. So be creative in that team and get someone from the strategic initiatives department to kind of think differently than the food science or the food safety or the data management people will think about.

[00:30:55] Because we're more of the, you know, dig in, get into the details kind of folks. Yes, absolutely. And I think people are thinking differently now with the layer of AI and we're not saying, Hillary and I are not saying use AI for everything. But I think things are, people are being more creative in a way with data. Exactly. And actually FDA is asking that question too.

[00:31:15] Is there a layer, if you've heard Dr. Don Prater speak on traceability and even the initiatives at FDA, there's a number of initiatives that utilize AI at FDA. And, you know, is there an opportunity to either enhance or facilitate or speed up the process through an AI application? So those I think are all really great questions to consider for the future. I think what that looks like, we're not quite clear yet.

[00:31:43] What we can do and what we can't do given the specificity of the regulation. But I think it's all definitely open for discussion. And FDA is asking the same questions. Which is great. It's great. This has been awesome. I think for all of our listeners and our collective listeners, because we're going to send this out to all of the different associations that we work with collectively. I think everybody's going to be really interested in that. We asked two questions at the end of our podcast. Okay.

[00:32:12] The first, what is the favorite technology that you're using right now? It can be work related or in your personal life. So I think everyone is kind of dabbling in AI right now and what tools are available. I love hearing recommendations from friends or colleagues on, you know, what tool are you using and what are you working on? So my family and I love to travel.

[00:32:38] And, you know, I was able to put a travel itinerary in an AI tool and it was game changing. It was so easy because it was able to tell me, okay, to get from this city to this city, you know, this is the recommended route, but these are optional routes and things like that that I would have never thought of. So it was really cool.

[00:32:59] So just even with travel planning that I do on, you know, my own time and limited time, you know, how can AI, you know, help you figure out your itinerary and your travel plans? And, you know, if you take a train, train transfers, do you need a rental car? All of that kind of stuff. So that's kind of fun. Yeah. Well, you brought me back when you said itinerary. I thought about people won't know what I'm talking about. The trip ticks from AAA. It's like an electronic and you don't even have to think about it. It's just right there. That's so cool.

[00:33:29] Exactly. It was. Yeah. So it just, I mean, you still have to plan and, you know, figure out where you're going, but just putting it into AI, it was so easy to see. Second question. Is there something new you want to learn about in the future? Oh, that's a big list. There's a lot. You know, one thing, this might seem crazy for this audience, but the things that I didn't have time to study, when I was in school or younger, like I have a newfound interest in history.

[00:33:59] I never thought about being a history major in college. I was a food science major. All of my electives were taken up by prerequisites for, you know, whatever I had to do. And I was in the lab most afternoons. So I didn't have extra time. I want to go take art history. I want to take, you know, American revolutionary history. I mean, just the things that I took for granted and kind of missed. So that's a big one.

[00:34:24] But I think there's also, there's so many other things that I want to explore and dig into. But, you know, kind of having, and a lot of folks will relate to this, but, you know, anyone who went through a science degree knows you didn't have time for anything else. You just kind of took your classes and, you know, went through school. So, you know, my children are college age now.

[00:34:49] And, you know, I'm encouraging them to take philosophy and take history and, you know, take something that you normally wouldn't take. So do a little dabbling. Exactly. Yeah. And I think it helps your brain do exercise different strengths. Exactly. Yeah. Cool. Well, Hillary, thank you so much for joining us.

[00:35:09] I know that everybody will get a ton of information about what FISMA 204 is and also how to like start that journey down the compliance route. So thank you. Thank you. Great to talk with you. Thank you for joining the Next Level Supply Chain with GS1US. If you enjoyed today's show, you can subscribe to our feed or explore more great episodes wherever you get your podcasts. Don't forget to share and follow us on social media. Thanks again, and we'll see you next time.