What You Need to Know About Defending Against Intentional Contamination

Intentional contamination of the food or water supply is a historical issue dating as far back as medieval times when diseased animal carcasses were catapulted into fortified cities that had reduced food supplies. Who would have thought that the food industry would ever need programs to protect against intentional product contamination?

Only 25 years ago, the focus in the food safety field was on product quality and production. Food facilities didn’t even have written allergen programs in place. A lot has changed in the food industry over the past few decades, causing consumers to demand more oversight to ensure the safety of their food. Today’s food and beverage industry has to satisfy consumers who are more health conscious, as well as regulatory requirements, such as the Food Safety Modernization Act (FSMA). One of the newest and most complicated programs included in the Act is food defense.

Food defense programs reduce or eliminate the potential for someone to intentionally contaminate an ingredient, packaging, or finished product through vulnerability assessments and procedural and physical security measures to mitigate the risk.
 

The Bioterrorism Act.

The Bioterrorism Act of 2002 was created after FDA conducted a risk assessment and identified potential gaps and a true lack of protective measures in the food industry. Prior to the Act, most food manufacturers hadn’t given much thought to developing programs for intentional contamination. To comply with the Act, food facilities need a food defense program, a trained coordinator, and additional food defense team members.

The team should include members from different departments, including front-line employees since they have daily access and exposure to products and can provide valuable information. Other people to consider for the team include the plant manager, human resources, quality department, production manager, IT department, legal advisor, and CEO or CFO.

Companies are required to conduct facility vulnerability assessments to determine risks and develop strategies to reduce the risk of intentional contamination or harm to employees. Once the assessment is complete, a food defense plan should be developed.
 

FSMA’s New REquirements.

New requirements have been proposed under FSMA, which could require facilities to develop an overall mitigation strategy and focused strategies for actionable process steps. Actionable process steps are processes that pose a higher risk of intentional contamination and could create significant public harm. These are currently listed in the proposed rule as bulk liquid receiving and loading, liquid storage and handling, secondary ingredient handling, and mixing and similar activities. Food plants can use a variety of procedural and physical security measures to prevent intentional contamination. These may include:

• Employee training (limited access)
• Alarm systems
• Fencing
• Security guard services
• Access control systems
• Visitor and contractor control programs
• Exterior lighting and security cameras
• Personnel surveillance (locker inspections)
• CCTV monitoring
• Food defense inspections
• Lock and key control
   

How Have You Adapted?

Following are some questions you need to ask yourself when developing a food defense team and programs to ensure you are in compliance with the Bioterrorism Act and with FSMA’s proposed changes.

• What changes has your facility made to protect against intentional contamination?
• Is your building secure?
• Do you still conduct plant tours?
• Are visitor and contractor procedures different?
• What are the operation’s critical areas (mixing, blending, bulk storage)?
• Have you assessed them to make sure they’re secure?
• Have customers asked you for food defense programs?
• Who is your qualified individual that oversees the food defense program?

Specifically, focus on protection against intentional adulteration and complying with facility registration requirements.

Testing Your Food Defense.

Food defense and food safety are completely separate programs. Most plants already have programs in place to protect against accidental contamination. These include master cleaning schedules, GMPs, HACCP, and integrated pest management. Food defense is the protection against intentional contamination. Many facilities lack fully developed written programs and physical measures, or fail to monitor and manage the programs that are in place.

Similar to food safety, once food defense programs are implemented they have to be tested and evaluated to ensure they are effective. The best way to challenge your food defense program is to conduct security penetration tests to see if the safeguards you have in place can hold up to a targeted attack. During the test, an individual will simulate an attack or attempt to violate your facility’s established security procedures to find technical, procedural, and physical weaknesses. This will help you determine whether intentional harm or contamination is possible. You’ll discover ways that a perpetrator could compromise security and gain access to sensitive areas and information within your facility, as well as how well your employees are prepared to discover and respond to security events.

The person conducting the penetration test should be someone who does not work at the facility or is not well known. He should attempt to enter the facility via all possible approaches, including silos, roof, bins, and maintenance areas. If able to enter, he will look around and note what potential acts of intentional contamination are possible with the resources on hand. This person will continue throughout the facility until he is stopped by personnel. Once the test is completed, review the notes and vulnerability assessment and make any necessary changes to mitigate the vulnerabilities identified.

Every facility and operation is different. A parent company may own five bakeries, but each will have completely different risks and hazards based on location and plant setup alone.

Unlike a food safety program for which a model can sometimes be used and applied to similar facilities, every plant will have different risks and controls and have to be evaluated independently for food defense.
 

Getting on Board.

The food industry certainly faces some obstacles and threats in protecting against intentional contamination. It may be difficult to convince upper management that the threat is real. However, a food defense program is something every plant that produces, packs, or holds food products must develop and maintain for preventive measures to comply with regulatory requirements. If your customers require a GFSI certification audit or a GMP inspection you will have specific requirements for food defense. Also, there are requirements for importers and exporters to comply with, such as prior notice.

Even if your CEO and legal advisor don’t participate in meetings, both play a huge role in supporting the food defense program and team. If there was ever an intentional contamination event in your facility they would be front and center. Your team size will depend on your plant size and resources. Once the team is established and responsibilities assigned, the first order of business is to conduct a vulnerability assessment. Similar to HACCP, the process involves a series of steps. Compare HACCP’s Seven Principles with the Operational Risk Management (ORM) for food defense—the processes are very similar.

The authors are Food Defense Expert (Arnold) and Food Safety Professional (Leal).