FDA FSMA compliance consulting for food safety you can show an FDA investigator.

What it is

What is FDA FSMA and what is it used for?

The FDA Food Safety Modernization Act is the US federal law that moved the Food and Drug Administration's food safety work away from responding to outbreaks and towards preventing them. It gave FDA new powers, among them mandatory recall when a company will not recall unsafe food voluntarily, suspension of a facility's registration, and a duty on importers to verify that their foreign suppliers have adequate preventive controls.

The law works through rules. Each rule targets a part of the supply chain: the facilities that manufacture, process, pack or hold food; the farms that grow produce; the importers who bring food in; the vehicles that move it; and the records that let FDA trace a food back through the chain quickly. Working out which rules reach you, and which exemptions apply, is the first job in any FSMA programme.

Current position. The foundational rules are final, most of them since 2015 and 2016. The newest, the Food Traceability Rule, was published on 21 November 2022; its compliance date, originally 20 January 2026, is now 20 July 2028, following a Congressional directive in the Continuing Appropriations Act of 2026.

Who it is for

Who needs FDA FSMA compliance?

FSMA follows the food, not the flag. A facility in Manila, Dubai or Pune that must register with FDA is inside the Preventive Controls rules just as a plant in Ohio is. Businesses usually reach Sterling from one of four directions:

• A US customer or importer sends a supplier questionnaire. Importers must verify their foreign suppliers under FSVP, so they ask exporters for the hazard analysis, the controls and the records behind them.
• You are bidding for US retail or food-service business. Buyers want to see that the food safety plan, allergen controls and recall plan exist and work before they list a product.
• FDA is part of your life, or about to be. A facility registration, an upcoming inspection, an import alert on your category or the Food Traceability Rule date is pushing the programme up the agenda.
• A group company is exporting to the US. A parent wants one approach across its plants, so each site's plan meets the rules and the group can show it consistently.

FSMA asks for control that shows in the records, kept by the people running each shift.

Requirements

What are the main FDA FSMA requirements?

FSMA requirements sit in its rules, and each rule has its own scope, exemptions and compliance dates. Below are the rules FDA names as foundational, at title level; your programme is checked against each rule that applies to you and FDA's guidance on it.

• Preventive Controls for Human Food: updated current good manufacturing practice, plus a written food safety plan with a hazard analysis, process, allergen, sanitation and other preventive controls, a supply-chain programme where needed, a recall plan, monitoring, corrective actions and verification.
• Preventive Controls for Animal Food: the equivalent framework for facilities making or holding food for animals.
• Foreign Supplier Verification Programs (FSVP): US importers analyse the hazards in each food, evaluate the foreign supplier, verify it, take corrective action and reevaluate at least every three years or when new information arises.
• Produce Safety: farm standards for agricultural water, biological soil amendments, sprouts, domesticated and wild animals, worker training, health and hygiene, and equipment, tools and buildings; pre-harvest agricultural water has its own rule.
• Sanitary Transportation of Human and Animal Food: suitable, cleanable vehicles and equipment, temperature and cross-contact controls in transit, carrier training and records.
• Mitigation Strategies to Protect Food Against Intentional Adulteration: a food defence plan with a vulnerability assessment, mitigation strategies at actionable process steps, monitoring, corrective actions and verification.
• Food Traceability: key data elements for critical tracking events on foods on the Food Traceability List, a written traceability plan, and records supplied to FDA within 24 hours of a request.
• Accredited Third-Party Certification and Laboratory Accreditation for Analyses of Foods: third-party auditors for specific import programmes, and accredited laboratory testing.

Compliance process

How do you become FSMA compliant?

There is no certificate at the end of an FSMA programme. Compliance is something you keep up every day and demonstrate when FDA inspects, when an importer verifies you or when a customer audits. Sterling helps you build and run the programme; FDA alone judges and enforces compliance.

1. 01
   Establish which rules apply.Registration status, activities, products, farm operations, import role, transport arrangements and any foods on the Food Traceability List decide your obligations and exemptions.
2. 02
   Gap analysis: compare current practice with the applicable rules.Existing HACCP or GFSI systems, CGMPs, supplier files and records are reviewed rule by rule, and actions, owners and dates are agreed.
3. 03
   Build the plans and put them to work.The food safety plan, FSVP files, traceability plan, food defence plan and transport procedures, as they apply, with your preventive controls qualified individual and your operators trained.
4. 04
   Verify that the controls work.Records review, internal audit, a mock recall and a 24-hour traceability exercise test the programme; we raise the findings first and close them with evidence.
5. 05
   Stay ready for inspection and review.Reanalysis when products, suppliers or processes change, supplier reevaluation on schedule, and records ready for FDA investigators, importers and customers.

Check the route before you sign. Anyone offering an "FSMA certificate" is selling something FDA does not issue. Ask whether PCQI training follows a curriculum FDA recognises as adequate, and whether a customer actually wants FSMA evidence, a GFSI scheme certificate, or both. If a certificate is part of the request, confirm the certification body and its accreditation directly with the bodies concerned.

Cost

How much does FDA FSMA compliance cost?

A single-product exporter with a working HACCP plan needs far less than a multi-site processor handling listed foods and importing on its own account. Cost follows the rules in play and your starting point; every component is shown, and nothing is added later.

Timeline

How long does FSMA compliance take?

Most programmes take months: as an estimate, three to nine, depending on how many rules apply and how much of a preventive system already runs. The plans can be written quickly; the time goes into running the controls long enough to produce monitoring, verification and supplier records that show they work.

If an importer's deadline or a US listing date is driving the work, tell us at the first meeting. We will say plainly what can be ready by then and which decisions need to be made early.

Your engagement

What your FSMA engagement includes

An FSMA engagement covers every rule in your scope, from the first applicability review to the records that keep the programme alive. Sterling does not certify, and no one can certify FSMA compliance: FDA inspects and enforces. Sterling OS™ sets the support level. With Design™ we guide your team while it builds the programme; with Drive™ we manage the build and your people run it with us. You choose one or the other. Sustain™ keeps the programme current once it is in place, and Automate™ is Effivity.

• Applicability review, gap analysis and plan

  The rules that apply, the gaps against each, and a dated plan with owners, agreed before work starts.

• Plans, procedures and records

  Food safety plan, FSVP files, traceability plan, food defence plan and transport procedures, as they apply, built with your people.

• Effivity ISO & GRC software

  Plans, logs and supplier files kept in Effivity from day one, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal audit, mock recall and traceability test

  Conducted or facilitated as agreed, with findings closed with evidence.

• Inspection and customer readiness

  Preparation for FDA inspection, importer verification and customer audits, working alongside your legal advisers where regulatory questions arise.

FDA alone determines compliance with its regulations; Sterling does not give legal advice.

Often combined with

Standards organisations pair with FDA FSMA (US)

• BRCGS Food SafetyBRCGS Food Safety certification consulting for food manufacturers: HACCP plan, site standards and controls ready for a graded audit, announced or unannounced.
• BRCGS Storage and Distribution · Agents and BrokersBRCGS Storage and Distribution certification and Agents and Brokers: Issue 4 and Issue 3 requirements, scopes, audits and cost factors, with Sterling's support.
• FairtradeFairtrade certification and requirements: which Fairtrade International standards apply, FLOCERT's audit, cost and timing, and how Sterling prepares you.
• FAMI-QS / GMP+FAMI-QS and GMP+ certification for feed businesses: how the two schemes differ, their requirement documents, the audit route and how Sterling prepares you.
• FSSC 22000FSSC 22000 certification consulting for GFSI-recognised food safety: ISO 22000, sector PRPs and FSSC requirements, ready for a licensed body's audit.
• GLOBALG.A.P.GLOBALG.A.P.