In May 2016, FDA issued its final rule on Mitigation Strategies to Protect Food Against Intentional Adulteration (IA). This rule requires covered facilities to prepare and implement food defense plans. The first compliance date—for businesses with sales of $10 million or more per year and more than 500 full-time equivalent employees—is July 26, 2019. (Note that small businesses have until 2020 and very small businesses have until 2021.)

Just as important, FDA has announced it will begin routine inspections to verify compliance with the IA rule in March 2020. Given those dates, compliance with this rule should be a top priority for the approximately 3,400 impacted firms that operate 9,800 food facilities.

Requirements: Food Defense Plan

Let’s start by defining food defense and why it is so important. According to FDA, “Food defense is the effort to protect food from acts of intentional adulteration.” Intentional adulteration is any act where there is an intent to cause wide-scale public health harm, including acts of terrorism. As such, the rule is designed to primarily cover larger facilities with products that reach many people.

At its most basic level, the IA rule requires every covered facility to prepare and implement a food defense plan. The food defense plan incorporates four major elements:

1. The vulnerability assessment identifies those areas in the process that pose the greatest IA risks. Each step in the facility’s process should be evaluated for the following:
   • Potential severity and scale of the impact on the public
   • Physical access to the product
   • Ability to successfully alter/contaminate the product
2. Facilities must develop and implement mitigation/preventive strategies at each step in the process to address vulnerabilities and minimize the risks of IA.
3. A system must be put in place to ensure implementation of mitigation strategies and to effectively manage the following:
   • Monitoring mitigation strategies, including frequency
   • Corrective action response
   • Verification activities
4. Appropriate recordkeeping must be maintained for food defense monitoring, corrective actions, and verification, and key personnel must receive appropriate training.

Mock Exercise

Kestrel’s previous article on the Four A’s of Food Defense outlines a proactive approach to food defense that will help meet a key requirement by ensuring the organization is working to avoid the risks associated with food adulteration and contamination.

In addition, when conducting an assessment of food defense, IA, and generally accepted industry vulnerability, threats, and controls, Kestrel suggests completing a mock exercise scenario. This allows companies to:

1. Assess their food defense and IA programs under FSMA;
2. Test to confirm their program’s integrity, as documented and implemented; and
3. Conduct vulnerability scenarios to verify, validate, and make improvements. 

The following areas should be addressed in the assessment, strategies, and plan information:

• Facility
• Materials
• Packaging
• Processing
• Key activities
• Storage
• Transportation and distribution
• Management and personnel

A key aspect is also review of and improvements to training programs for all employees based on responsibility, recordkeeping process, management objectives, and program monitoring.

This activity provides the information needed to develop and implement an effective and compliant food defense and IA program under FSMA. Additionally, it can provide verification of the site’s programs, corrective actions to be implemented, and the necessary records of compliance.

Piece of the Puzzle

Food defense is a big piece of the FSMA puzzle. According to Kestrel Food Safety Principal Bill Bremer, “We have included food defense in virtually all of our program development activities this year for GFSI (all schemes) and now FSMA.” Kestrel has worked with over 400 food sites in passing audits and inspections that have included general or focused food defense and IA management programs in food categories including baking, candy/confection, meat, flavor/ingredients, grain, flour, packaging/contact materials, beverages, beans, chemicals, dietary supplements, commissary/catering, and more.

Doing so directly aligns with FDA’s requirements for companies to assess risk and implement preventive controls on a broad basis. Thinking about risk-based strategies—whether in the supply chain or internal systems or whether you are a grower or an importer—is key for any food company planning for the future. Preventive strategies are the essence of FSMA and HACCP. Proactively creating or updating a food defense and safety plan is the first step to ensure compliance.

Join Kestrel at the PROCESS EXPO, as we discuss this topic and others during our special food safety training courses this October in Chicago.