A Food Defense Plan Is Good for Business

Food defense experts Capt. Jon Woody, Ryan Newkirk, and Colin Barthel of the FDA Center for Food Safety and Applied Nutrition Food Defense and Emergency Coordination Staff have made every effort to make all stakeholders aware and inform and educate the global food industry and regulating bodies, writ large, on agency expectations in how to comply with the new FSMA IA Rule. In addition, these agency “owners” have also been instrumental in developing “Mitigation Strategies to Protect Food Against Intentional Adulteration: Draft Guidance for Industry” (published in June 2018 with the public comment period closed in December 2018), on how to best comply with agency IA Rule expectations prior to the publication of its final guidance document.

The IA Rule applies to the owner, operator, or agent in charge of a domestic or foreign food facility that manufactures/processes, packs, or holds food for consumption in the U.S and is required to register under section 415 of the FD&CA, unless one of the exemptions provided in 21 CFR 121.5 applies. (21 CFR 121.1)

Let me briefly review the key FDA-directed food defense facility compliance qualifications and responsibilities as contained within the IA Rule. In regards to the qualifications:

• Are you the owner, operator, or agent in charge of a domestic or foreign facility that manufactures/processes, packs, or holds food for consumption in the U.S and is required to register with FDA? (21 CFR 121.1)
• Does your business (including any subsidiaries and affiliates) average less than $10,000,000, adjusted for inflation, per year, during the three-year period preceding the applicable calendar year in sales of human food plus the market value of human food manufactured, processed, packed, or held without sale (e.g., held for a fee)? If so, your facility is exempt, except that you are required to provide for official review, upon request, documents sufficient to show your status as a very small business. (21 CFR 121.5(a))
• Does your facility hold food, except the holding of food in liquid storage tanks? (21 CFR 121.5(b))
• Does your facility pack, re-pack, label, or re-label food where the container that directly contacts the food remains intact? (21 CFR 121.5(c))
• Is your facility a farm mixed-type facility that conducts activities that fall within FDA’s “farm” definition? (21 CFR 121.5(d))
• Does your facility produce alcoholic beverages? (21 CFR 121.5(e))
• Does your facility manufacture, process, pack, or hold food for animals? (21 CFR 121.5(f))
• Is your facility a farm mixed-type facility whose only activities that would be subject to section 418 of the FD&CA are on-farm manufacturing, processing, packing, or holding of eggs (in-shell, other than raw agricultural commodities) and certain game meats? (Note that this is limited to small and very small businesses. (21 CFR 121.5(g)) If applicable, your business is exempt from compliance with the IA Rule.

If you must comply with the IA Rule, the following are the principal tasks your food-related business must formally address:

1. Develop and implement a written Food Defense Plan that includes (21 CFR 121.126):
   • A vulnerability assessment, including required explanations, to identify significant vulnerabilities and actionable process steps (21 CFR 121.130(c));
   • Mitigation strategies, including required explanations (21 CFR 121.135(b));
   • Food defense monitoring procedures (21 CFR 121.140(a));
   • Food defense corrective actions procedures (21 CFR 121.145(a)(1)); and
   • Food defense verification procedures (21 CFR 121.150(b)).
2. Food defense training and qualifications of supervisors and personnel working at actionable process steps. (21 CFR 121.4)

IA Rule records that must be prepared and kept include:

• The vulnerability assessment—for each point, step, or procedure in the facility’s operation, it must evaluate the severity and scale of the potential impact on public health if a contaminant were to be added, and the degree of physical access to the product;
• The ability of an attacker (from outside or inside the facility) to successfully contaminate the product (21 CFR 121.130);
• The mitigation strategies applied at each actionable process step to significantly minimize vulnerabilities—the facility must include a written explanation of how each strategy minimizes the vulnerability (21 CFR 121.135);
• Food defense monitoring of the mitigation strategies with adequate frequency to provide assurances that they are being consistently performed (21 CFR 121.140);
• Records of food defense corrective actions to be taken if mitigation strategies are not properly implemented (21 CFR 121.145); and
• Food defense verification that monitoring is being conducted, that appropriate decisions about corrective actions are being made, that mitigation strategies are being properly implemented, and that a reanalysis of the food defense plan has been conducted, as appropriate, according to 21 CFR 121.157. (21 CFR 121.150).

Maintaining Trustworthiness

So, why is food defense good for business?