FSMA’s Food Defense versus Food Safety

It was no surprise that within the Food Safety Modernization Act (FSMA), Congress directed FDA to address intentional contamination. The question was how the agency would address something that’s never happened in the U.S. on a grand scale.

Many times over the past decade, food safety professionals have wondered if the responsibility for food defense would rest with them. Is food defense primarily related to physical security; or is it amenable to a HACCP-like approach? We know a lot about Salmonella, E. coli, and Listeria. But are these the agents we would expect terrorists to use?

The proposed rule addressing food defense, “Focused Mitigation Strategies to Protect Food Against Intentional Adulteration,” does little to address these questions. The scores of vulnerability assessments conducted or overseen by FDA drew the agency to conclude that there are a few key vulnerable points in food defense, and require that “focused mitigation strategies” be implemented (and monitored) at those points. The operative word here is “focused.”

Should you have a secure perimeter? Should doors be locked or have access control? Should you conduct background checks on employees? Of course. But FDA likens these measures to GMPs: the general foundation of security. (FDA refers to these as “broad mitigation strategies.”) When it comes to the proposed regulation, the agency is looking for more. FDA is requiring facilities to put specific measures in place to protect the primary parts of a facility and/or parts of a process where a contaminant could be introduced.
 

“The big one.”

FDA is also reining in the scope of the rule by limiting it to those deliberate actions intended to cause mass public health harm, and to a lesser extent, economic disruption. This rule is intended to protect against “the big one”—a large-scale terrorist attack. While not focused on the disgruntled employee (with legitimate access and intimate knowledge of the facility), FDA expects that the measures put in place will have a positive impact on these types of actions too.

Further, the issue of economically motivated adulteration (EMA) is outside the scope of this proposed rule. The preamble states that FDA intends to include EMA in the next round of the preventive controls rule. This is because perpetrators of EMA probably don’t want to cause a public health impact. Illness or death would expose their fraudulent practices, and their money-making gig would be over. Instead, FDA submits that EMA can be addressed in a hazard analysis to determine the likelihood that such contamination is “reasonably likely to occur.”
 

Food defense vs. food safety.

So how is this different from food safety and the preventive controls rule proposed by FDA? In many ways, the structure of the rule is similar: focused mitigation strategies need to be monitored; there need to be planned corrective actions in place; and there is a strong recordkeeping component to demonstrate compliance with the rule.

A key difference between the proposed rules lies in how risk is assessed. The approach proposed in preventive controls is one of “hazard analysis,” whereas the approach in the food defense rule is one of “vulnerability assessment.” The food defense rule does not require facilities to know anything about the agents that might be used in an attack. What matters is where agents might be introduced. FDA identified a number of areas where it believes the ability to access and introduce a contaminant warrants the implementation of “focused mitigation strategies.” These high-risk “actionable process steps” include bulk liquid receiving and loading, liquid storage and handling, secondary ingredient handling, and mixing and similar activities.

The proposed rule goes on to suggest how vulnerabilities might be mitigated at these points. FDA acknowledges that it is difficult, if not impossible, to validate these types of mitigations, but proposes to require that they be monitored and verified in such a way and with such frequency as deemed appropriate by the facility.

For facilities that don’t have one of the high risk “actionable process steps,” or for those that do but want to do a comprehensive vulnerability assessment anyway, to whom does this task fall? FDA proposes that a covered facility needs to have someone capable of performing a food-defense vulnerability assessment. At points, FDA refers to this person as a “qualified individual.” But FDA does not elaborate on what qualifies an individual to perform these evaluations and develop a meaningful food defense program. Using the term “qualified individual”—the term used in the proposed preventive controls and foreign supplier verification program rules—can cause confusion. Unlike the other proposed rules, the term “qualified individual” appears only in the preamble, not in the proposed codified food defense rule. Here the responsibility is simply allocated to the owner, agent, or operator in charge of the facility.

In addition, FDA is proposing to require that individuals working on the “actionable process steps” be trained in the general principles of food defense and receive specific training related to the area in which they work, to ensure that they understand and are able to implement the focused mitigation strategies. FDA suggests that the agency-developed “food defense awareness for the front-line employee” provides the requisite general food defense awareness training.

Over the past several years, FDA has invested considerable resources developing tools to help firms address food defense. It’s difficult to measure success—who knows how many terrorist attempts have been thwarted? But it is clear that FDA has taken into consideration the work and research conducted in the development of these tools, and has thought through many angles in drafting this rule. Additionally, the agency is seeking comments on several critical components—including those that show similarities to proposed food safety rules. But even if you consider food safety and food defense to be different beasts, delivering safe food, free from unintentional and intentional contamination, is our responsibility, and this rule will certainly impact food safety professionals.