Food Facilities Must Develop Food Defense Plans under FSMA
On May 27, 2016, the U.S. Food and Drug Administration (FDA) published its final rule for “Mitigation Strategies To Protect Food Against Intentional Adulteration,” the last of the seven major rules under FDA’s Food Safety Modernization Act (FSMA). The rule requires most food facilities that must register with FDA to develop and implement a written Food Defense Plan for human foods manufactured, processed, packed, or held at the facility. Food Defense Plan development can be broken into three steps:
Step 1: Vulnerability Assessment
Covered facilities must assess significant vulnerabilities for each actionable step that takes place at the facility (mixing, cooking, labeling, packaging, etc.), including:
- The potential impact on public health
- The degree of physical access to the product
- The ability to successfully contaminate the product
The assessment must be written and must include an explanation as to why each point, step, or procedure was or was not identified as an actionable process step. Assessments must consider the possibility of an inside attacker.
Step 2: Mitigation Strategy Development
Once a facility identifies the vulnerabilities associated with their food operations, it must identify and implement mitigation strategies to minimize or prevent those vulnerabilities. The Food Defense Plan must include written explanations for how each strategy will sufficiently mitigate the corresponding vulnerability. An example of a mitigation strategy would be placing numbered seals on a load before transportation. This would allow the recipient of the load to ensure the same seal was unbroken upon arrival, verifying that the load was not tampered with. Another example would be the use of locks to limit access to vulnerable areas within the facility.
Step 3: Maintenance
Covered facilities must monitor their mitigation strategies to ensure they are properly implemented. A facility’s Food Defense Plan must identify its monitoring procedures and how often they will occur. If monitoring reveals that a mitigation strategy was not properly implemented, facilities must take corrective actions. Facilities must also conduct verification activities to ensure that both monitoring and corrective actions, if necessary, are being conducted. Facilities must maintain records for food defense monitoring, corrective actions, and verification activities.
Required activities under FDA’s Intentional Adulteration rule must be conducted by one or more qualified individuals. The qualified individual(s) must:
- Prepare the Food Defense Plan
- Conduct the vulnerability assessment
- Identify and explain the mitigation strategies
- Conduct reanalyses of the Food Defense Plan (required at least once every three years)
FDA defines a qualified individual as “a person who has the education, training, or experience (or a combination thereof) necessary to perform an activity required under [this regulation], as appropriate to the individual’s assigned duties.” A qualified individual may be an employee of the facility or a third party.
Most covered facilities must comply with FDA’s Intentional Adulteration rule by May 27, 2019 (three years after publication of the final rule). Small businesses (defined as businesses with fewer than 500 full-time equivalent employees) have one additional year to comply.
Very small businesses are exempt from most requirements under FDA’s Intentional Adulteration rule. In order to take advantage of this exemption, businesses must provide records to FDA proving their very small business status by May 27, 2021 (five years after publication of the final rule). FDA defines a very small business as ” a business (including any subsidiaries and affiliates) averaging less than $10,000,000, adjusted for inflation, per year, during the three-year period preceding the applicable calendar year in sales of human food plus the market value of human food manufactured, processed, packed, or held without sale.”
There are a few exceptions to FDA’s Intentional Adulteration rule, such as the holding of food (except food held in liquid storage tanks), food for animals, and alcoholic beverages under certain conditions. View FDA’s final rule for a complete list of exemptions.
Registrar Corp is a U.S. FDA consulting firm that helps food facilities comply with FDA regulations, including new requirements under FSMA. Registrar Corp’s Food Safety Specialists can develop or review a Food Defense Plan for compliance with FDA’s Intentional Adulteration rule. For questions or assistance, contact +1-757-224-0177 or chat with a Regulatory Advisor 24-hours a day at www.registrarcorp.com/livehelp.