Are You Set to Defend Against Intentional Adulteration?

The Food Defense Rule is in effect — are you in compliance? Or, to address it from a more pragmatic angle — are you prepared to defend against the potential intentional adulteration of your food products?

As of July 26, 2019, larger businesses were to be in compliance with FSMA’s Final Rule for Mitigation Strategies to Protect Food Against Intentional Adulteration (generally referred to as the IA Rule or the Food Defense Rule). Small businesses, of fewer than 500 full-time employees, have another year to comply (July 26, 2020). Very small businesses, averaging less than $10 million per year, are exempt from the rule, except that by July 26, 2021, they must be able to show documentation verifying that they meet the exemption.

However, neither the extended time frames nor the exemptions mean that you should take food defense lightly and put off, or completely dismiss, ensuring facility and employee preparedness and development of a food defense plan.

The IA Rule is primarily designed to prevent acts intended to cause wide-scale harm to public health, including acts of terrorism targeting the food supply. But it also includes provisions for measures to help prevent or minimize insider attack, such as that by a disgruntled employee — to which even the smallest of food facilities can be subject. In fact, according to a 2018 survey of food industry representatives conducted through a collaboration by The Acheson Group (TAG) and the Food Protection and Defense Institute (FPDI), 62% of the food processors, manufacturers, and distributors surveyed rated employees as their top food defense concern.

Unfortunately, according to the TAG and FPDI analysis of the survey results, Intentional Adulteration & Food Defense — Industry Preparedness Report (https://bit.ly/2YbHPu9), at the time of the survey, 78% of those covered by the IA Rule were unaware of the draft guidance published by FDA, and only 62% of those had reviewed or commented on the guidance. Since that time, FDA has published the second of three parts of the intended guidance, but as of the effective date of the rule, the third part had not yet been released.

Despite the lack of the third part and the conversion of the guidance from draft to final, food processors — large and small — are well advised to review and apply all guidance as applicable to their operations. It is particularly important to review the guidance released in its draft form, as this provides the opportunity to make comments and recommendations prior to the final being developed. Although guidance is non-binding, it represents the current thinking of FDA and, essentially, provides free advice and recommendations on how to best comply with the related rule.

This can be especially helpful in the writing of the Food Defense Plan (FDP) required by the IA Rule. Although a very high percentage (91%) of those surveyed had an existing plan, only 50% had developed or updated it after publication of the IA Rule. So, while you may have a plan in place, it may not be fully compliant with the provisions of the rule. FDA has stated that it does not intend to begin IA Rule-focused inspections until a year after its effective date, however it will tack on a few focused questions to its regular inspections, primarily asking about (and likely wanting to see) the FDP. And the agency will expect you to have one.

A second essential requirement of the IA Rule is that of training. The rule requires (and guidance further explains) different levels of training for different facility roles. This ranges from awareness training for front-line workers to more comprehensive training for qualified individuals responsible for the Food Defense Plan and related activities. Front-line worker awareness training can be completed through in-house training, online resources, or external trainers. However, qualified individuals are required to complete a training that is at least equivalent to the standardized curriculum recognized as adequate by FDA, which includes identifying and explaining mitigation strategies at actionable process steps identified by a vulnerability assessment, or be otherwise qualified through job experience to conduct the specified activities.

Interestingly, while it may be expected that smaller companies would be more likely to use outside resources, more of the surveyed large (63%) than small (46%) companies used FDA online tools such as the mitigation strategies database or the FDP Builder software. FDA also has updated these tools to reflect the IA Rule, so — like the guidance — they provide a valuable resource for understanding and compliance.

As is recommended in the conclusion of the Industry Preparedness Report, whether or not you are specifically covered by the IA Rule, and no matter when your company must comply, a Food Defense Plan will help protect your product against acts of intentional adulteration or outright terrorism — and help protect your business and brand as well.

If you have not completed any of the report’s seven recommended steps (assess, plan, conduct vulnerability assessments, determine actionable process steps, identify mitigation strategies, evaluate, and educate and train), you are well-advised to complete these now. It can only benefit you.

For more information on the survey and seven steps, download the Industry Preparedness Report.