Best Food Defense Plan? Cue the Offense

Detecting a perpetrator in the act of intentional product tampering is extremely difficult. However, being alert to indicators and warnings about employee behavior may signal the need for closer worker supervision and surveillance. Employees may observe peculiar, erratic, or threatening behavior in another employee, and such incidents need to be reported and verified.

“Leveraging what we already know in terms of the knowledge of the ingredient/product, the packaging, and the process flows within a facility, is paramount in developing an effective vulnerability assessment, mitigation strategy, and, ultimately, a food defense plan,” says Park. Trained and experienced qualified individuals are required to take the responsibility in satisfying IA rule requirements, as well as implementing other food defense best practice requirements. “It all ties into using a comprehensive approach when developing and implementing a food defense plan,” Park continues. “I see the benefits of including a third-party outside food defense professional, too, whether they’re addressing physical security gaps or operational flow within the facility that identifies exposed ingredient, product and packaging contamination opportunities. The approach to food defense is not one size fits all.”

Using the right vulnerability assessment, mitigation, and food defense plan development tools can provide those responsible for determining a potential incident’s probability severity and criticality. Many plants now rely on tools other than FDA’s Food Defense Plan Builder version 2. “It’s not required,” Park says, but “obviously, you need to follow a systematic approach in following a food defense strategy.” 

FDA’s guidance documents outline important considerations in food defense without being overly prescriptive. “There’s enough flexibility in what FDA has presented, even though their guidance is lengthy. This provides the food facility with a number of options in not only responding to the IA rule regulations, but developing an effective food defense program that improves the chances an intentional adulteration event will be deterred or detected before product is distributed to the public,” Park explains.

There are a variety of best practices for the planning, implementation, and maintenance of a food defense program, according to Arnold. First is identifying a program leader who has an understanding of food defense or is trained in the requirements. Second is conducting a detailed vulnerability assessment that focuses on the production process. “When assessing, things like a criminal asking, ‘How would a person that wanted to do something bad be able to do so?’ The answer should help identify potential significant gaps [where] you should develop and implement controls,” Arnold states. He advises being realistic in developing controls by evaluating whether they would seriously reduce the potential for someone to cause harm. “Those controls should then be implemented and documented, while also being reviewed and improved as you progress,” he adds.

Time to update your plan?

Arnold says it is a best practice for food and beverage facilities to review their food defense plans annually. “Regulations may have different requirements though. FDA states plans should be reviewed a minimum of every three years or when significant changes occur that could affect the facility, or when a mitigation strategy isn’t working correctly,” he adds. 

Park says that a food defense plan re-analysis and updates need to occur when a food facility has:

1. Normal scheduled changes in a physical facility that include equipment design or installation layout changes, changes in key personnel, new ingredients/products or packaging material suppliers, and significant or different processing steps, for example. 

2. Any time new vulnerabilities are introduced because of examples in number one above. 

3. Re-analysis is required more frequently than the three-year mandatory re-analysis requirement that is in the IA rule if significant change introduces new vulnerability.

4. If plant managers or food defense team members learn information from industry sources, trade associations, and publicly disclosed incident or shared intelligence reports that new or previously unidentified potential vulnerabilities associated with their facilities and similar or same products exist, the facility needs to review their food defense plans.

Arnold agrees processors should conduct a food defense vulnerability assessment and develop mitigation strategies as needed. FDA has specific requirements on what is included within a vulnerability assessment, he explains, and the assessment must include reviewing all products and all processing steps. “When assessing each processing step, you must consider access to the product, the ability to contaminate, and the public health impact if a contaminant is added at this processing step. If significant vulnerabilities are identified, meaning a vulnerability, if exploited, would reasonably cause wide-scale harm, then implement controls. And when conducting the assessment, I must consider an insider could be the bad person.” 

Helping manufacturers succeed

“Monitoring, verification, and recordkeeping also are required to ensure that your facility has designed and implemented an effective food defense plan,” says Park. “In these early months of IA rule implementation, FDA wants to engage in broad discussions to make sure your facility is actively working toward full IA rule compliance. The agency understands that this process requires transparent government/industry communications that involve highly sensitive information and has assured industry that such information exchanged will remain government protected. Education and training efforts will be ongoing and require a significant investment in both time and financial resources, not only for the food facility, but also for FDA to meet the intentions of the IA rule.

“Facilities with food defense programs that are under third-party auditing bodies don’t always align with the detailed food defense plan requirements of the IA rule,” Park says. While certification bodies are becoming more robust in food defense requirements, it is still a top-level auditing effort. “An audit, in my opinion, is different than an assessment,” he states. “GFSI (Global Food Safety Initiative) schemes check top-tier questions related to regulatory compliance, but, as audits generally do, are designed to identify only significant gaps, but are not designed to specifically suggest new opportunities for food defense plan improvements.” 

Make plans to visit PACK EXPO International to see the latest technologies for food processing and packaging machinery and materials.