[Cover Story] Global Food Defense

In the last year, AIB has seen a rapid increase in requests for Food Defense services. This is due in part to added requirements of the AIB Consolidated Standards for Inspection, as well as increased federal regulations regarding food protection. In its Food Protection Plan, the FDA has requested authority to require mandatory preventive controls for intentional contamination, including vulnerability assessments. Also, more and more top companies are requiring their suppliers to complete facility vulnerability assessments in order to be competing business partners.

But, besides the fact that food defense has become an industry—and regulatory—driven necessity, what are the other benefits that a detailed vulnerability assessment can offer? Before we go any further, ask yourself the following questions:

• Is your entire employee base trained on food defense awareness?
• Do you know who has access to each area of your facility?
• Can you assure your customers that all incoming raw materials have been inspected for signs of contamination?
• Is the packaging used at your facility tamper-evident?
• Are all chemicals and hazardous materials secured and accounted for?
• Does your recall program include procedures and practices to handle acts of intentional contamination?
• Are there measures in place to prevent proprietary information from getting into the wrong hands?
• Do your programs prevent theft?

A vulnerability assessment identifies areas where a food facility, its people, and the products produced are at risk of intentional contamination or harm. The assessment helps determine the level of risk so that resources can be strategically and effectively applied to minimize these risks and strengthen the physical site, the existing programs, and the operational procedures. This differs from food safety and HACCP programs which are designed to identify, eliminate or reduce unintentional contaminants in food products.

Reasons for Implementing
a Food Defense Plan

In September 2008, less than three months after a customer at a supermarket chain in Tokyo found a poison warning sticker on the bottom of a bottle of chicken sauce, the corporate office of that supermarket chain received a letter demanding tens of millions of yen. The sauce had been found to be contaminated with a non-fatal amount of the herbicide, glyphosate. The company quickly reinforced security at its stores and cooperated with investigators.

Intentional product contamination or malicious acts can cause great harm to a company, its brand and employees. Before you think that your company is off the radar and safe from "attack," you might want to consider these facts:

• About 800 workplace homicides occur each year in the U.S. alone.
• More than 50 percent of all supermarket theft is attributed to employee pilferage.
• Disgruntled employees often seek revenge on their employers by causing product contamination or by sharing proprietary information with others.

As you can see, food defense incidents are not limited to product contamination. Most losses related to food defense events can be categorized into one of four categories:

Physical – This could include loss of building structures, product, personnel, vehicles, etc. depending on what is targeted.

Economic – This includes loss of product, personnel expenses, medical costs, legal fees, decontamination of facilities, disposal of materials, downtime, business loss, and loss of suppliers and customers, etc.

Psychological – The panic or lack of confidence that consumers experience related to a brand, product or company as a result of an incident.

Political – If the contamination is widespread, it could cause dissatisfaction in the government’s ability to regulate and protect its people.

There is no corner of the world that is immune to food defense events. Food defense is often thought of as the United States’ response to the terrorist attacks that occurred 9/11, but there is so much more than potential terrorist attacks to consider when looking at facility vulnerabilities. There have been numerous food defense incidents where product contamination or loss of personnel or property had nothing to do with terrorist activity.

In 2009, a break-in at Beechgrove Farm, a poultry farm in Edinburgh Scotland, left 136,000 chickens dead. Raiders tampered with environmental controls that regulate conditions in the chicken sheds. The air supply was cut off to 12 sheds, causing the chickens to suffocate and costing an estimated 400,000 euros.

How many facilities have suffered economic loss due to theft of products or property? What risks are there to the product and the brand when stolen product is mishandled, intentionally contaminated and sold outside proper channels and controls? What costs are associated with downtime or when transportation equipment is stolen?

Equipment that is stolen or intentionally damaged may lead to loss of production or the ability to distribute product. When recovered, repair or replacement will create an additional economic burden that is placed on the company.

Why do facilities, vehicles and trailers have locks on the doors? It is done because a risk has been identified and measures implemented to prevent theft, vandalism, contamination and economic loss. Locks are in place to discourage and restrict access to people with the intent of doing harm. These are just a few of the countless examples of non-terrorist related food defense threat that occur worldwide.

Determine the Risk —
The Vulnerability Assessment

There are various threat assessment tools and resources available to use to evaluate your site or you may decide to develop your own evaluation program. In doing so, there are four vulnerability assessment categories to consider:

People. Although food safety issues can and do occur based on environmental, mechanical, and other factors, the driving force in any food defense incident is people related. When determining vulnerabilities in your company, closely examine how you deal with employees, contractors, visitors, and any other people who enter your facility.

Any non-employed guests, including visitors, tour groups, customers/suppliers, sales personnel, contractors, and regulatory representatives should be required to read and agree to your Visitor Policy before they are allowed to enter the facility. These guests should be clearly identified as visitors and treated as such, regardless of how often they visit the facility. It is the company’s responsibility to control visitors and monitor their activity within the facility.

With visitors, the concern that they might directly contaminate the product is certainly not the only thing to consider. In Pennsylvania, a baker entered his competitor’s bakery five times in two days. While on-site, he stole an employee uniform to access classified areas of the facility and stole binders containing 66 of his competitor’s recipes, which were valued at over $30 million.

There are other concerns related to employees. It seems that the number of news stories about disgruntled employee actions, particularly workplace violence events, rises every year. With the global economic situation creating an alarming number of layoffs and downsizing, it is increasingly important to have a plan to identify and respond to disgruntled employees before an intentional contamination or an act of workplace violence occurs. On top of that, there are the "lover’s revenge" acts of workplace violence that seem to occur more and more often. Pre-employment screening is a useful tool, but will not prevent these "inside" acts from occurring. Your company needs to educate its employees to recognize the warning signs that lead to workplace violence or intentional product or property damage and how to report any signs they notice.

Facility and Equipment. Theft, property damage, unauthorized access and vandalism to company buildings and equipment can easily be deterred with a few strong security measures and policies. Does your company use CCTV systems to monitor activity that takes place both inside the facility and outside on the property? Common security measures, such as fences, exterior lighting, CCTV surveillance systems, security signage, and access control can go a long way in preventing theft and damage to company vehicles, buildings, equipment, etc.

Processes and Procedures. Just like food safety processes and procedures, those related to food defense must be water-tight and followed consistently in order for them to be truly effective. During a vulnerability assessment, evaluate areas of the process or job-related tasks that could provide an avenue for intentional contamination or harm, then determine countermeasures to address the risks. Something as simple as a mail handling policy, an employee locker inspection policy or an access control program can go great lengths in preventing food defense incidents. During the vulnerability assessment, create a list of existing company policies and procedures. Evaluate these from a food defense standpoint and make necessary improvements. Then, create or update the policies and procedures that are needed to address identified company risks.

Utilities.What would happen if a contaminant was added to your company’s water supply? How long would it take to determine if such an event occurred? In many food companies, water is used as a production ingredient or as a main component of sanitation activities. Or, what would happen if your motor control center was sabotaged? Although it would not create direct product contamination, it would certainly disrupt product manufacturing and cause downtime.

It has been only 18 months since Britain’s counter-terrorism minister warned of a building terrorist threat in the works. He assured that the government had established plans to protect water supplies, resilience, underground trains and communications in case of such an event. Does your company have its own plans in place in the event that utility systems were the target of an attack?

During the vulnerability assessment, address the risks or potential for loss due to interruptions or contamination of air, water or electricity. Pinpoint locations throughout the facility and outside grounds where utilities are vulnerable to tampering or sabotage, then develop measures to prevent these events from occurring. Utilities may also be included as part of the Crisis Management Plan.

Development of
the Food Defense Plan

Once a vulnerability assessment is complete, risks and weaknesses will need to be evaluated in order to develop a Food Defense Plan that is rational, practical for the facility, and makes the best use of company resources. This is done by examining the likelihood and severity of each identified risk. Low risk and low severity items will not merit the same consideration, controls or resources of high risk or high severity items. This evaluation will ensure that resources are properly allocated based on risk.

When this evaluation is complete and areas of control have been identified, the facility can develop a Food Defense Plan and allocate the resources needed to ensure that appropriate protocols and infrastructures are in place to manage risks. The goal of the Food Defense Plan is to implement procedures in layers, like that of an onion, so that each time a layer of defense is peeled back there is another layer in place to discourage or prevent an incident from occurring.

A simple example is a fence. Fenced facilities have an additional barrier in place to prevent or discourage unauthorized access to the building or property. This additional layer of protection is not available to non-fenced sites that rely solely on locked doors to restrict access. However, this does not mean that all facilities are required to install a fence to meet food defense requirements. In urban areas where there are increased risks due to population or crime statistics, the installation of a fence may be the best use of resources to provide needed access control. But in rural areas that do not have the same population or crime pressures, resources may be more effectively used for other programs where higher risk or severity is identified. This is a simple example of how important a vulnerability assessment and risk analysis is in determining how to allocate food defense resources.

Other Considerations

In addition to determining the risks and implementing a plan that makes sense for the facility, there are other elements of program implementation to consider. Personnel need to be trained on the importance of food defense as well as their roles and responsibilities in order to achieve a successful program.

In the event of a security breach or food defense incident, appropriate protocols should be defined and include who will be notified, how incidents will be handled, and how the plan or the facility will reassess the program to determine if additional changes are needed to prevent future failures from occurring. In addition, an annual review of the program should occur to ensure that there have been no significant changes that would affect the program.

Conclusion

Food Defense Programs are not just an American requirement designed to prevent terrorist attacks. Vulnerability assessments and Food Defense Plans are global tools designed to prevent intentional contamination and harm to the people, facilities, and products in the food industry worldwide. AIB

The authors are Director, Product Development, and Publication Coordinator respectively for AIB International.