ASTA Ready-to-Eat FAQs

July 2018

The microbial safety of “ready-to-eat” (RTE) foods is a hot topic that ASTA is hearing a lot about when it comes to implementation of the Food Safety Modernization Act (FSMA). The U.S. Food and Drug Administration (FDA) has not yet published guidance regarding classifying and processing RTE foods. In these “frequently asked questions” (FAQs), ASTA is sharing information on positions FDA could take on RTE based on the preambles to the FSMA final rules, talks that FDA officials have given, information published in the update to the spice draft risk profile, informal conversations with FDA officials, and other published FDA draft guidance. ASTA has produced these FAQs in order to help members understand FDA’s current thinking on RTE foods, but we note that we have not received input on this document from FDA.

ASTA is providing these FAQs as a service to ASTA members solely to share information on issues related to clean, safe spices – specifically, issues associated with RTE foods. The information we are providing is accurate and factual to the best of our knowledge as of July 2018, but ASTA does not provide any warranties of any kind regarding this information. This information also does not constitute legal advice. ASTA members are advised to consult with their own legal counsel regarding FSMA compliance. ASTA reminds its members that they each bear an independent responsibility to comply with all applicable laws and regulations.

What is “ready to eat”?
Ready-to-eat food (RTE) food is defined by FDA to mean any food that is normally eaten in its raw state or any other food, including a processed food, for which it is reasonably foreseeable that the food will be eaten without further processing that would significantly minimize biological hazards 1In plain language, this means that a RTE food is safe to eat as-is, without any further processing.

What initial questions do I need to ask when deciding if my product is RTE?
To determine whether your food is RTE, you need to assess whether you have adequately controlled for all of the applicable potential hazards for the food. Ask yourself questions such as:

  • Have you conducted a hazard analysis to assess the potential for known or reasonably foreseeable hazards for your product?
  • Do you have preventive controls in place for each of the hazards identified through your hazard analysis?
  • Have you validated that your process controls achieve adequate lethality for biological hazards?
  • Does your process potentially introduce additional hazards that require control (e.g., through post-processing contamination due to environmental exposure)?
  • Is any further processing necessary to ensure the food is safe for consumption?

Do I need to perform a hazard analysis for spices I process?
Yes, under the regulations established by FSMA, regardless of whether your food is RTE or not ready-to-eat you need to conduct a hazard analysis.2 The hazard analysis identifies and evaluates known or reasonably foreseeable hazards for each type of food manufactured, processed, packed, or held at your facility to determine whether there are any hazards requiring a preventive control. The hazard analysis must consider biological hazards, including microbiological hazards such as Salmonella, Listeria and E.coli, chemical, and physical hazards.

As part of the hazard analysis, you must assess the severity of the illness or injury if the hazard were to occur and the probability that the hazard will occur in the absence of preventive controls; you must include an evaluation of environmental pathogens whenever an RTE food is exposed to the environment prior to packaging and the packaged food does not receive a treatment that would significantly minimize the pathogen. You also must consider the effect of certain specified factors on the safety of the finished food for the intended consumer.

Can I conclude that there are no biological hazards for spices?
FDA’s position is that certain biological pathogens (e.g., Salmonella) need to be identified as hazards requiring a preventive control for spices. FDA has published a list of the potential hazards associated with different types of foods and includes the following biological hazards for untreated/raw and treated herbs and spices: Bacillus cereus, Clostridium botulinum, C. perfringens, pathogenic E. coli, and Salmonella spp.3 Although this list is only the potential hazards (i.e., hazards requiring further evaluation through the hazard analysis), we understand that FDA’s position is that Salmonella is a hazard that should be identified for all herbs, spices, and seasonings.

What does “treated” mean?
The spice industry often refers to “treating” spices to mean the application of a microbial reduction process, such as steam, irradiation, Ethylene Oxide or Propylene Oxide, with the “treatment” acting as a preventative control for pathogens that provides adequate lethality for pathogen reduction. In other words, “treated” spices have been subject to a validated kill step to control biological hazards.

Must all spices be treated for pathogens if they are RTE?
As discussed above, FDA’s position is that certain biological pathogens (e.g., Salmonella) need to be identified as hazards requiring a preventive control for spices. The Preventive Controls regulation requires that facilities implement preventive controls that will significantly minimize or prevent all hazards requiring a preventive control that have been identified through the hazard analysis. Accordingly, the agency is essentially requiring that all spices sold to consumers be subject to a preventive control that will address hazards from pathogens such as Salmonella.

Do I need to treat spices in my facility, or can the treatment occur further down the supply chain?
The Preventive Controls regulation provides that you do not need to implement a preventive control (e.g., treating spices) if the hazard (e.g., Salmonella) will be controlled through further processing by a commercial customer.4 Thus, if a customer will further treat the spice or use it in a product that will then undergo a kill step, and certain other requirements are met, then you do not need to treat the spice yourself.

To take advantage of this flexibility in the rule, the product you distribute must be properly labeled to disclose to the downstream manufacturer that the identified hazard has not been controlled (e.g., “Not Processed to Control Salmonella”).5 FDA has issued guidance on these disclosure statements.6 Note that the regulations also provide that you need to get a written assurance from your customer about control of the hazard, but this written assurance provision is not being implemented. FDA may reinstate the written assurance requirement in a modified form in the future.7

If untreated spices are sold to another manufacturer for further processing, how do I make the declaration that they are untreated (“disclosure statement”)?
The disclosure statement “not processed to control [identified hazard(s)]” must be made “in documents accompanying the food, in accordance with the practice of the trade.” FDA has advised in draft guidance that appropriate documentation could include labels, labeling, bill of lading, shipment-specific certificates of analysis, and other documents or papers associated with the shipment that a food safety manager for the customer is likely to read.8 FDA also advises that it is not sufficient to reference a website in a document of the trade without including the disclosure statement itself in the document of the trade. FDA also does not recommend that documents such as contractual agreements, letters of guarantee, specifications or terms and conditions be used to communicate the disclosure statement. This is because such documents generally are not specific to a particular shipment, and some of these documents may not be available to the customer’s food safety manager.

Do I need disclosure statements for a RTE food?
Disclosure statements are only necessary if you do not control all of the hazards in the food. If your food is RTE, you should have identified all of the hazards requiring a preventive control identified through your hazard analysis and therefore would not need to disclose any hazards to a downstream customer. (In other words, if you are making a disclosure statement, the food is not RTE.)

If I am not treating a spice, do I need to provide a disclosure statement?
If you identify a hazard requiring a preventive control, do not control the identified hazard, and rely on a subsequent commercial entity in the distribution supply chain to address the hazard, you need to make a written disclosure. However, the written disclosure cannot be used in lieu of implementing a preventive control if the food is not going to be subject to further commercial processing that will control the hazard(s). In other words, the written disclosure cannot be used with consumer-facing/retail products.

What do I need to do if I am controlling the hazard myself?
If you are controlling a hazard at your own facility, you need to implement a preventive control that will significantly minimize and prevent the identified hazard. Preventive controls need to have corresponding procedures for monitoring, verification and corrective actions to ensure that they are appropriately implemented.

In particular, as part of the umbrella of “verification” FDA will expect: (1) that you validate the efficacy of your preventive control (e.g., have validation to demonstrate that your kill step is effective to control for Salmonella)9 and (2) engage in environmental monitoring if post-processing contamination is identified as a hazard requiring a preventive control.10

What is environmental monitoring?
Environmental monitoring involves collecting and testing samples from the facility’s environment to identify potential sources of contamination and then taking appropriate corrective actions based on the test results. Environmental monitoring is a verification activity – not a preventive control. It helps you ensure that your preventive controls are effective, but does not actually control the hazards. Successful environmental monitoring programs take a seek-and-destroy approach, actively trying to identify pathogens and potential means of ingress. A strong program will aim to eliminate environmental pathogens from non-food contact surfaces as a means to keep the pathogens from contaminating food contact surfaces and thereby contaminating food.

Is environmental monitoring necessary for RTE foods?
As set out in the regulations, FDA expects facilities to perform environmental monitoring when RTE foods are exposed to the environment after processing.11 The regulations also provide that environmental pathogens must be evaluated whenever a RTE food is exposed to the environment prior to packaging and the packaged food does not receive a treatment or otherwise include a control measure (such as a formulation lethal to the pathogen) that would significantly minimize the pathogen.12 Environmental monitoring often is performed as a verification of sanitation controls when contamination of a RTE food with an environmental pathogen is identified as a hazard requiring a preventive control.

If the product is intended to be cooked by the consumer, can their cooking process be considered a kill step?
FDA’s position is that companies should not be relying on consumers to perform a kill step, such as cooking, in their homes. The potential for consumer misuse must be considered as part of the hazard analysis. It is known that consumers use a number of products in ways that are not the intended use and as a result there is no cooking/kill step. FDA also has advised that consumer-level labeling about the need for further preparation is not sufficient. Examples of consumer misuse include the potential of mixing taco seasoning with sour cream to make a dip or adding spices to a finished meal without further cooking. Thus, FDA’s position is that all products sold to consumers should be RTE.

I blend other ingredients into a spice or seasoning mix. Do those ingredients also need to be RTE?
Yes, if the seasoning blend is sold directly to consumers, all of the ingredients must be RTE. For example, a taco seasoning mix that includes flour, which is a potential source of Salmonella, would need to be made using flour that has been treated for Salmonella or the entire seasoning mix would need to undergo a kill step. When a hazard is controlled by your own supplier (or another entity that precedes you in the supply chain), you need to implement a supply-chain program that meets FDA’s supplier verification requirements so as to confirm that your supplier is adequately controlling the hazard.13

1.  21 CFR § 117.3.
2.  21 CFR § 117.130.
3.   Hazard Analysis and Risk-Based Preventive Controls for Human Food: Draft Guidance for Industry; Appendix 1: Potential Hazards for Foods and Processes, at 1P. Available at:
4.  21 CFR § 117.136(a)(2)-(4).
5.  21 CFR § 117.136(a)(2)(i), (3)i), and (4)(i).
6.  FDA Draft Guidance, Describing a Hazard That Needs Control in Documents Accompanying the Food, as Required by Four Rules Implementing the FDA Food Safety Modernization Act: Guidance for Industry (“Disclosure Guidance”),
7. FDA Guidance, Policy Regarding Certain Entities Subject to the Current Good Manufacturing Practice and Preventive Controls, Produce Safety, and/or Foreign Supplier Verification Programs,
8. Policy Regarding Certain Entities Subject to the Current Good Manufacturing Practice and Preventive Controls, Produce Safety, and/or Foreign Supplier Verification Programs: Guidance for Industry.
9.  21 CFR § 117.160.
10.  21 CFR § 117.165(a)(3).
11.  21 CFR § 117.165(a)(3).
12.  21 CFR § 117.130(c)(1)(ii).
13.  21 CFR Part 117, Subpart G.