Producers Must Comply With Intentional Adulteration Regulation
AFI Staff Report
FDA’s implementation of the Food Safety Modernization Act is not yet complete. The last of the foundational rules, dealing with Intentional Adulteration, has been in place for two-plus years. The regulation establishes requirements to prevent or significantly minimize acts intended to cause widescale public harm. It covers all facilities that manufacture, process, pack or hold human food. Facilities must create a food defense plan that details vulnerability to intentional adulteration, the strategies to combat that vulnerability and how the company will monitor and verify those procedures to make sure they are effective.
Compliance dates were staggered based on business size. Large businesses, defined as businesses with more than 500 employees, had an original compliance date of July 2019, with the date for small businesses (less than 500 full-time equivalent employees) set for July 2020. Very small businesses, defined as those with less than $1 million in revenue, are exempt from the rule, although they do need to file documentation proving they are a very small business. FDA announced it wouldn’t begin any IA inspections until March 2021. As with other FSMA rules, it’s expected will use enforcement discretion for one to two years to “educate while we regulate” and focus on instructing companies how to come into compliance rather than enforce any penalties.
FDA said that when inspections begin for facilities covered by the IA rule they will consist of food defense plan “quick checks” during regularly scheduled food safety inspections. These “quick checks” allow FDA to verify the facility has satisfied the basic requirements of the rule while also providing the agency that opportunity to “educate while we regulate.” During the “quick check” FDA investigators will ask the owner or operator of the facility a series of questions such as “do you have a food defense plan?” and may provide some educational materials.
The Need for a Food Defense Plan
The food defense plan is a set of written documents based on food defense principles. It incorporates a vulnerability assessment, mitigation strategies and delineates food defense monitoring, corrective action and verification procedures to be followed. The plan must include:
The plan must be put together by a qualified individual, defined in the Preventive Controls for Human Food regulations as “an individual who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by FDA or is otherwise qualified through job experience to develop and apply a food safety system.” FDA recommends manufacturers put together a food defense team, which could include people from security, maintenance, food production, sanitation, etc.
Conducting a Vulnerability Assessment
The first step is to conduct a vulnerability assessment, to look at each point, step or procedure to identify the highest risk for adulteration. It should focus on people and places where they come directly in contact with the food. A facility must analyze the potential public health impact, degree of physical access to product and the ability of an attacker to successfully contaminate the product(s). Inside attacks are more likely than adulteration from the outside.
There are three methods recommended by FDA to do a vulnerability assessment—Key Activity Types, 3 Fundamental Elements and the Hybrid Approach.
Key Activity Types
The Key Activity Types and general categories of manufacturing that have been identified as most vulnerable to intentional adulteration include:
Manufacturers are expected to analyze each point, step or procedure related to these key activity types to see where intentional adulteration could occur and to develop and implement a plan so that does not happen. The plan must be written.
3 Fundamental Elements
The three fundamental elements are another means to identify vulnerability. They are:
Even though it’s uncomfortable for family-owned and employee-friendly specialty food businesses, FSMA stresses that the food defense plan must address the possibility of an insider attack and protect against that threat. Insiders are more dangerous because they have access to the facility and understand how it operates.
FDA put together a worksheet that can assist manufacturers in determining the potential public health impact. Element 1 uses aspects of production such as batch size, amount of product in final servings, and servings per batch.
FDA created a template to help calculate vulnerability. For instance, a 10 represents more than 10,000 people and/or servings at risk; a 5 means between 100 and 1,000 people and/or servings at risk. Element 1 also considers information on contaminants that could be used to adulterate the product.
Element 2 addresses the degree of physical access to the product. Again, a score is assigned. A 10 would mean that the product is easily accessible, such as:
Element 3 relates to the ability of an attacker to contaminate the product. Bulk liquid receiving and breading score high in that a contaminant could easily spread in these steps.
After scoring the 3 Elements, manufacturers can determine their vulnerability to an attack. FDA also accepts a Hybrid Approach, which combines the 3 Fundamental Elements and Key Activity Types. The agency stresses there’s flexibility in each facility’s approach and that the person making the food understands where and how a product can be adulterated better than anybody.
The mitigation strategies requirement states that manufacturers must identify and implement mitigation strategies at each actionable process step to provide assurances the vulnerability at each step will be significantly minimized or prevented. FDA defines mitigation strategies as “risk-based, reasonably appropriate measures a person knowledgeable about food defense would employ to significantly minimize or prevent significant vulnerabilities identified at actionable process steps and that are consistent with the current scientific understanding of food defense at the time of the analysis.”
Minimizing accessibility is the primary goal of the mitigation strategies. These can start as facility-wide security measures to protect personnel, property or product. Security can serve as a foundation for a mitigation strategy but, by itself, is not a mitigation strategy. It needs to be supplemented with other strategies, which can be personnel, operations or technology-based. Examples in the guidance include techniques such as using tamper-evident tapes or seals for partially used ingredient containers and installing locking mechanisms on equipment access points. Other examples include requiring workers at actionable process steps to wear uniforms or clothing without pockets or other means to conceal items and increased observation of highly vulnerable areas. Placing cameras in the facility is not a mitigation strategy unless the cameras are monitored regularly.
In the food defense plan, each mitigation strategy must include an explanation of how it significantly minimizes or prevents the vulnerabilities associated with the actionable process step.
Food Defense Monitoring
Food defense monitoring consists of observations or measurements that assess whether mitigation strategies are operating as intended. The monitoring must be written or recorded. FDA recommends monitoring be periodic but is more effective at irregular intervals, so a potential attacker cannot determine when the monitoring is taking place. The guidance states that facilities must:
Document monitoring in records that are subject to verification
Record information at time of observation, and
Capture observations and actual values, along with the time and date observation was made, and the signature or initials of the person who made the observation.
FDA’s Food Defense Plan Builder
FSMA requires many people involved in the production of food be made aware of the Intentional Adulteration Rule. The Food Safety Preventive Controls Alliance developed several programs which meet the regulation’s training requirements. The Food Defense Awareness Program is required of all frontline food workers and supervisors of frontline food workers. It’s an online course that takes about 30 minutes to complete and is free. FSPCA also offers a course entitled Overview of the IA Rule, which will inform employees of the regulation but is not required. An in-person training program launched this spring for those interested in in-depth training. AFI strongly recommends all suppliers and importers take FSPCA courses related to their sector and perhaps even for their suppliers or customers. The FSPCA is a public-private partnership funded by FDA. The FSPCA’s mission is to create educational programming regarding the various FSMA rules.
As noted earlier, the food defense plan must be overseen by a food defense qualified individual. Their responsibilities include:
FDA created an online tool called the Food Defense Plan Builder.
2021 U.S. Food Import Industry Annual Report
Chairman's Report - James Libby
President's Report - Bob Bauer
North American Olive Oil Association - Marco de Ceglie
Processed Foods - Josh Gellert
Nut & Agricultural Products - Travis Walvoord
National Honey Packers & Dealers - Greg Olsen
Regulatory and Trade Issues