Feeling Vulnerable?

The year 2012 will bring about a new type of change to the food industry. Until now, there have been no formal requirements for food plants to have a Food Defense Plan in place that outlines measures that will protect against intentional contamination. However, the Food Safety Modernization Act (FSMA) has added a requirement for the FDA to issue regulations to “protect the food supply against intentional contamination due to sabotage, terrorism, counterfeiting or other illegal, intentionally harmful means.” For example, similar to HACCP’s relation to food safety, FDA is required to issue regulations specifying appropriate science-based measures to prepare and protect the food supply chain from intentional adulteration at specific vulnerable points, as appropriate. FDA is to begin issuing information on requirements in early 2012, then it will follow a pre-set timeline on the issuance of specific provisions.
 

Be Proactive. Even before all the specific regulations are released, food companies can begin assessing possible risks and vulnerabilities that may be present in their facilities and proactively identifying ways to strengthen biosecurity protection, as well as enhance the safety and security of employees, assets, and brand. This exercise, known as a Vulnerability Assessment, is an essential tool to determine existing risks and weaknesses in the physical site, programs, and operational procedures that might increase exposure to a terrorist event, workplace violence situation, or other incident. Ask yourself:

• Is your entire employee base trained on food defense awareness?
• Do you know who has access to each area of your facility?
• Can you assure your customers that all incoming raw materials have been secured during transit and have been inspected for signs of contamination?
• Is the packaging used at your facility tamper evident and/or tamper resistant?
• Are all chemicals and hazardous materials secured and accounted for?
• Does your recall program include procedures and practices to handle acts of intentional contamination?

A good Vulnerability Assessment will help you answer all these questions and more. AIB has been providing Food Defense Vulnerability Assessments for our clients for nearly a decade and has identified some of the most common vulnerabilities identified in today’s food plants. These include:
 

1. No Food Defense Plan in place.
Food facilities that do not have an established Food Defense Plan in place fail to comply with FDA, USDA, and DHS established guidelines and recommendations for food defense and facility protection. A well-rounded plan will include identified security vulnerabilities, physical and procedural security measures to prevent intentional harm, a designated food defense team with assigned responsibilities, and contact information for government and company contacts.

Members of management should complete a formal food defense training course to give them basic security and facility protection information and knowledge. A crisis management/food defense team should be created and responsibilities assigned to each member. This team should be listed in the full version of the facility food defense plan.

A food defense plan will not only help your company know what steps to take in the event of an incident, it will also give suppliers and customers peace of mind, knowing that your company is taking necessary precautions to protect their food.

2. Security signage is lacking.
Security signs posted around outside grounds and facility premises can be a great way to make employees and guests aware of the company policies and expectations. Some of the most common security signs that are needed in food facilities include “No weapons on premises”; “No trespassing”; “Bags subject to search”; “No cameras”; “Vehicles subject to search”; etc. When proper signage is lacking around a facility it can lead to someone unknowingly violating a company policy.

Proper signage is also essential to ensure that established rules and regulations are properly followed. Place these signs strategically around the property, inside the facility, and at every parking lot entryway and building entry door.
 

3. Unsatisfactory visitor and contractor management program.
When companies don’t check the identity of visitors and contractors entering their facilities, they become vulnerable to someone with ill intent entering the facility under false identity. During a vulnerability assessment at one facility, the AIB representative witnessed a man enter the building without any type of identity check being done. He arrived on the premises in a regular vehicle and was not wearing a uniform of any type. He informed the security guard that he was the “ice cream vendor” and was given access to the facility. Imagine the potential harm this person could have created if he was at the facility with the purpose of creating product contamination or employee harm.

Every food company should establish a visitor control policy that ensures that the ID of all visitors and contractors is checked. Photo identification should be checked for all non-employees at the facility. Use a visitor log, and verify visitor ID and signatures. Record the visitor’s vehicle information in the log. Visitor badges or armbands are a critical need for all facility guests, including contractors. Without their use, visitors can walk around the facility at any time with no official credentials.

Visitors and contractors should also be required to review the on-premise security rules. Such items may include specific requirements for designated areas, workplace harassment policy, use of cameras and cell phones, wearing of visitor badges, reporting suspicious activity, etc.

In addition, any visitors that bring bags or briefcases with them to the facility should be required to allow the receptionist to look inside to check for unauthorized items, (such as weapons or cameras) being brought into the facility. With laptops, the receptionist should record the serial number upon entrance of the visitor and verify the number upon exit. This will prevent someone from swapping his or her laptop with a company laptop containing classified information.

Some plants allow too much unrestricted facility access to non-company truck drivers delivering or picking up loads. In many instances, the facilities are set up so that drivers must walk through sensitive and critical production areas in order to access a restroom or vending area. This provides an open opportunity for someone with ill intent to do major harm and potentially contaminate open batches of products by gaining access to these critical areas. One way to combat this vulnerability is to build a secure area with a restroom and vending machine along the side or rear perimeter of the facility for truck drivers to wait in while their vehicles are loaded or unloaded. This eliminates the need for the drivers to walk through the facility and production areas to accesses these amenities, thus reducing the vulnerability to intentional contamination.
 

4. Perimeter and interior doors are not numbered or restricted.
Unnumbered perimeter and interior doors can lead to improper evacuations or delay in an emergency response if people are trapped in the facility. Every perimeter door should be numbered on both sides with large, reflective numbers to aid in emergency response. Also, to aid in workplace violence/crisis management situations, consider placing reflective numbers on the bottom of all inner facility and office area doors.

Entry and exit doors for employees, visitors, and contractors should be restricted and all perimeter doors not in use for regular entry or exit should be equipped with a local audible alarm or a detex alarm. Once installed, these door alarms should be tested on a monthly basis and the results indicated in the facility defense plan. This will allow for better control and management over facility operations and accessibility. As a recommendation, there should be only one or two doors for employees to enter and exit.

5. Insufficient outdoor lighting.
Adequate lighting around the facility is essential in providing security for employees and visitors. There are many areas, especially in the rear and sides of a facility, where someone with ill intent could hide and commit a crime, such as rape or assault, as employees are walking to their cars if adequate lighting is not provided.

Outdoor lighting should be evaluated and increased if necessary, especially in parking areas and in the rear of the facility. Also, each outdoor perimeter light should be numbered and included in the preventive maintenance program.
 

6. Mock evaluation planning and training.
Emergencies could happen at any time and with little warning. Employees must be shown the proper escape routes from the facility in case of an emergency evacuation. Many companies have a fire escape plan in place, but drills are rarely practiced and most often occur only during the first shift.

Conduct an organized, well-planned mock evacuation and involve local police, fire, and emergency medical services in the planning and implementation of the exercise. It is recommended that the hospital nearest to the facility be contacted and asked about their capabilities in dealing with a potential catastrophic event in the community.

Also, easy-to-read evacuation maps must be posted throughout the facility, providing employees and visitors with the proper information and guidance as to when, how, and where to evacuate the facility in case of an emergency.
 

Conclusion. While no steps can provide absolute protection, experience has shown that adoption of heightened awareness, basic defensive steps, increased monitoring or correction of vulnerabilities, and close coordination with local law enforcement will reduce the likelihood of a terrorist act. The most important threat reduction measure is vigilance on the part of an organization’s staff, their awareness of anything out of the ordinary, and their prompt communication of that information to the organization’s security team or management.

The author is Publication Coordinator, AIB International.