Small Business Food Defense Inspections Delayed, But Compliance Now in Effect

By Christopher Snabes

While FDA food facilities inspections are still on hold due to the pandemic, the agency is continuing to plan for and the reinstitution of inspections. The latest announcement was that routine inspections of small businesses for compliance with FSMA’s Intentional Adulteration (IA) rule will not begin until March 2021. However, even without the prospect of possible inspection small businesses were to be in compliance with the rule as of this week – July 27, 2020, to be exact.

If COVID-19 (or any other situation) has put you behind in compliance, or you simply want to take another look at your food defense program to ensure your facility is as protected as possible from potential vulnerabilities and insider or terroristic attacks, TAG has compiled a summary of the rule and some best practices. Read on:

A critical aspect of the rule is that it applies to facilities and producers that are not under other FSMA rules. If you produce juice, seafood, water, dietary supplements, or infant formula (which are held to other regulations such as Seafood HACCP, Juice HACCP, etc.), you are still required to comply with the IA Rule, even as a small business.

So just what does the rule entail? As we discussed in a previous recap of the IA rule, the two most important aspects of the rule are the written Food Defense Plan and training.

The Food Defense Plan (FDP). The first step in developing your FDP is a written vulnerability assessment which is the basis of the FDP. Through this assessment, you determine the Key Activity Types (KATs) of your facility for which risk mitigation is required. FDA has identified four KATs as being of high risk: bulk liquid receiving and loading, liquid storage and handling, secondary ingredient handling, and mixing and similar activities.

From your vulnerability assessment, actionable process steps (APS) and related mitigation strategies are determined by one of three methods:

1. Based on all KATs identified during the vulnerability assessment. Identification is easy and quick, however, in this method, every KAT automatically becomes an actionable process step (APS), so it may create unnecessary mitigation step(s) increasing the burden in your facility.
2. A vulnerability assessment conducted at each point, step, or procedure using the Three Elements (criticality, accessibility, vulnerability). Using a process flow chart, apply metrics to determine which process step can be identified as a KAT, and become an APS. Consider each of the three elements and score each using a pre-determined scale (or an internal scale if you can provide written justification). While the identification will take longer, it will often show that not all KATs need and APS or mitigation strategy, thereby reducing that burden.
3. The third option is a combination of the two: The Hybrid Vulnerability Assessment. Using just your identified KATs, the three elements are applied to determine a metric to establish an APS.

Once you’ve determined your actionable process steps, the needed mitigation strategies, and applied relevant management components (food defense monitoring, food defense corrective action, food defense verification) to each APS, your written Food Defense Plan can be completed and implemented.

Training. The IA Rule includes requirements for general awareness training and specialized Food Defense Qualified Individual (FDQI) training. Under the rule, every employee at an APS and their immediate supervisor are required to take Food Defense Awareness Training – this is general training that provides the employee and their immediate supervisor with the awareness of what food defense is, how they play a role, and why it is needed. Including information in this training on what your facility is doing also is beneficial.

More specialized training includes

• Key Activity Types (KAT), providing in-depth information on KATs and their assessment.
• Mitigation Strategies, which provides an explanation of these and assists businesses in the identification of best strategies to mitigate risk.
• Vulnerability Assessments. The most in-depth of the three, this course requires in-person training by a lead instructor who has been approved and certified by the FSPCA & AFDO.
• Food Defense Plan Preparation and Reanalysis.

With two certified Vulnerability Assessment Instructors (of which there are still a limited number worldwide), TAG can provide training in all these areas, as well as providing an in-depth assessment of your Food Defense Plan or assisting in its development if you’ve not yet gotten yours written.

FDA is not yet making routine inspections, but this does not mean you do not need to be in compliance. Once it begins making these inspections, FDA plans to “educate before regulate,” as it has for other rules. However, with the delays caused by COVID-19, FDA plans to limit this educate-before-regulate period to two years rather than the initially intended five years. Additionally, if you are not in compliance with the rule and an incident occurs, it will not only negatively impact your facility, business, and potential customers, it will result in non-compliance issues with FDA.

Give TAG a call today for training and/or a complete assessment of your food defense program.