Preparing for Intentional Adulteration Inspections & Quick Checks on Your Written FSMA Food Defense Plan
Christopher Snabes
There was a time during the 1940s when working in the food industry was considered a “war job.” It was said that food was the mightiest weapon of them all. Eight decades later, that phrasing still holds. Yet, while it once referred to the power of keeping troops fed, the message is reversed: Food can also be the mightiest weapon of them all when used against us. The intention of the Food Safety Modernization Act (FSMA) Intentional Adulteration Rule from the FDA is to prevent the mass harm that can be caused by contaminating the U.S. food supply.
What Is the Intentional Adulteration Rule? A Look at the Basics
The IA Rule recognizes that the greatest threat to our food supply is from an inside attacker—someone who has legitimate access to the production floor. This covers both domestic and overseas facilities that manufacture, process, pack or hold human food for the U.S. It’s important to note that the rule applies to Food & Beverage manufacturers not previously impacted by FSMA, including:
Low acid canned food
Infant Formula
Seafood HACCP
Juice HACCP
Dietary supplements
Bottled water
What Are the IA Rule Compliance Dates?
Food Defense Plans were required to be written by July 26, 2019, for the largest facilities and by July 27, 2020 for small businesses. The compliance date for very small businesses is July 26, 2021.
Food Defense Plans are site and facility specific, meaning that one company with multiple locations will need a unique plan for each.
A Food Defense Plan Overview
Food Defense Plans follow a plan similar to HACCP. The primary steps include:
A vulnerability assessment, which includes training a Food Defense Qualified Individual (FDQI), identifying Key Activity Types (KATs), and determining Actionable Process Steps
Mitigation strategies
Monitoring
Corrective Actions
Verification
Reanalysis
All steps must also be documented thoroughly.
IA Rule Training
Through the Food Safety Preventive Controls Alliance (FSPCA), Food Defense training is available for the Food & Beverage industry members. Food Defense Awareness Training is a free online course required for all employees at Actionable Process Steps and their immediate supervisors. The training is also specific to each APS, meaning the worker and their immediate supervisor must know what to do if an unauthorized person enters the area.
In addition to this mandatory course, the following optional IA Rule training is available:
Overview of the IA Rule, a free online course
Conducting Vulnerability Assessments Using KATs Only, a course which is available with a certificate for a fee (slides available to view online for free without certificate)
Identification and Explanation of Mitigation Strategies, an online course with a fee that comes with a certificate (slides available to view online for free without certificate)
Conducting Vulnerability Assessments, a course taught only by approved Lead Instructors; fee-based with a certificate. Will be taught remotely until August 31, 2021 (KAT and Mitigation training is strongly encouraged prior to this course)
Food Defense Plan Preparation and Reanalysis, a paid online course with a certificate (slides available to view online for free without certificate)
Note that you can also establish that you are trained in food defense without FSPCA courses through education and/or on-the-job training as long as it is documented.
Steps to Take Before Writing Your Food Defense Plan
Gathering some resources before writing your Food Defense Plan can help ensure the process runs smoothly. Here are a few steps to take in advance:
Assemble a Food Defense Team with multiple backgrounds. For instance, you might include someone from production, maintenance, sanitation, and HR, among other departments.
Gather your plant’s process flow chart.
Determine who needs to become a FDQI.
Conduct an initial written vulnerability assessment. Determine your KATs, which are:
Bulk liquid receiving and loading
Liquid storage and handling
Secondary ingredient handling
Mixing and similar activities
Options for Conducting a Vulnerability Assessment
You have two primary choices for conducting your vulnerability assessment.
First, you could conduct a vulnerability assessment based on your KATs. In this approach, you’d write a plan based on the KATs identified in the initial vulnerability assessment. The KATs are easy and quick to identify, and the FDA accepts this approach.
Yet, with this option, each KAT automatically becomes an Actionable Process Step. As such, this can unnecessarily increase your number of Actionable Process Steps, which would then increase your mitigation steps, leading to added complexity, capital expenditure, personnel, and management components.
In the second option, you can use the process flow chart, then apply metrics to each point, step, or procedure to identified an APS directly. This specifically addresses the inside attacker. The metrics are based on the three fundamental elements, which are applied and scored using a predetermined scale. This is known as, “The Three Elements” approach.
What Are the Three Elements of the IA Rule?
In the Three Elements approach, you’d look at each point, step, or procedure and rank each with a numeric score for each of the following categories:
Element 1 – Criticality. This refers to the potential public health impact (e.g., severity and scale) if a contaminant was added.
Element 2 – Accessibility. This measures the degree of physical access to the product.
Element 3 – Vulnerability. This refers to the ability of an attacker to contaminate the product successfully.
The Three Elements approach is beneficial because the scale for each element is pre-determined by the FDA. In addition, there is flexibility in the scoring of Element 1, allowing the FDQI to choose from the use of volume of food affected, a representative contaminant approach, or a contaminant specific approach which is the most specific, yet can be quite complex. The use of inherent characteristics (utilized in written justifications for scoring Elements 2 and 3) can affect a score that could exclude a KAT from becoming an APS when compared to using the KAT only vulnerability assessment option. Many companies can reduce costs such as investing in capital expenditures, time, training, and document maintenance when using this approach.
Nonetheless, the Three Elements approach is best applied by someone who has taken the IA VA course, which requires a fee and can only be taught by a Lead Instructor. It also requires a written explanation for processes that are not an Actionable Process Step.
A third option is the Hybrid Vulnerability Assessment. In this third approach, you’d use just the KATs identified based on the four types, then only score the KATs to determine whether they require an Actionable Process Step. This process is accepted by the FDA and allows for a thorough explanation behind your decisions. Yet, like the Three Elements Approach, it’s challenging to perform without taking the IA VA instruction course.
Food Defense Plan Reanalysis
Once you’ve developed and implemented the Food Defense Plan, you’ll also need to reanalyze it at a minimum of once every three years. A reanalysis is also necessary under any of the following circumstances:
Whenever there is a significant change that creates the potential for a new vulnerability or a substantial increase in one previously identified
When there is new information about potential vulnerabilities associated with a food operation or facility
When a mitigation strategy is not properly implemented
Whenever the FDA requires a reanalysis to respond to new vulnerabilities, credible threats, or developments in scientific understanding.
IA Rule & Food Defense Plan Implementation: Next Steps
The current Food Defense Plan Builder v2.0 is fully aligned with the IA Rule. It can upload the information you have in v1.0, which is no longer compliant.
Don’t wait to have a Food Defense Plan in place, as most facilities can expect a “Quick Check” any time now, and very small business.
There was a time during the 1940s when working in the food industry was considered a “war job.” It was said that food was the mightiest weapon of them all. Eight decades later, that phrasing still holds. Yet, while it once referred to the power of keeping troops fed, the message is reversed: Food can also be the mightiest weapon of them all when used against us. The intention of the Food Safety Modernization Act (FSMA) Intentional Adulteration Rule from the FDA is to prevent the mass harm that can be caused by contaminating the U.S. food supply.
FDA Quick Check IA Rule Inspections
Quick Check inspections will consist of a simple set of questions and will last for as long as the FDA deems necessary for the industry to understand the IA Rule and Food Defense Plans. The agency aims to educate before they regulate.
The FDA inspection strategy follows a two-tiered approach. First, Food Defense Plan Quick Checks will be conducted at all covered facilities and require very little investigator training. Secondly, there will be Food Defense Comprehensive Inspections conducted on a limited number of prioritized facilities. This will require specialized training for investigators, and inspectional resources will be focused on wherever the IA concern is highest.
Potential Quick Check questions could include:
Do you have a written Food Defense Plan?
Did a FDQI write it?
Did you conduct a Vulnerability Assessment?
Have you identified KATs?
Did you choose to use the Three Element approach?
Have you considered the possibility of an inside attacker?
Have you implemented Mitigation Strategies?
Has the Food Defense Plan been signed and dated by the FDQI?
Do you have Corrective Actions in place?
How are you verifying?
Have you had a Food Defense Incident, and if so, did you contact the FBI?
In Conclusion: Preparing for IA Rule Inspections
To begin preparing for an IA Rule inspection, facilities must have a written Vulnerability Assessment to determine whether they need a written Food Defense Plan. If an Actionable Process Step is identified, mandatory Food Defense Awareness training is required for the worker and their immediate supervisor. More than one individual can become a trained Qualified Individual, and employees can work together to form a small team. Based on the results of the Vulnerability Assessment, they can then create a written Food Defense Plan.
Finally, as you create and implement your facility’s Food Defense Plan, remember that food can indeed be the mightiest weapon of them all. By making food defense an ingrained aspect of your food safety program, you can minimize risks and help to promote the food supply.
