On May 27, 2016, the U.S. Food and Drug Administration (FDA) finalized a new food safety rule entitled “Focused Mitigation Strategies to Protect Food against Intentional Adulteration” under the landmark FDA Food Safety Modernization Act. As such, food defense under FDA has now moved from a voluntary program to a mandated requirement for many food establishments. However, most of the larger food wholesalers have already established active food defense programs to protect their brand as well as to meet third-party audit requirements.  The regulated industry may also look beyond the rule requirements for additional measures that may afford another layer of protection. A strong cost-benefit analysis before initiating any elective measures is essential. Within this article, the importance of food defense and awareness training, those training requirements found in the new FDA rule, and information that should be helpful in a cost-benefits analysis when considering training beyond the Rule requirements will be discussed.

While the scope of this article does not permit going through each of the new rule requirements in detail, a discussion of FDA’s overall approach to the rules and an assessment of the approach with regard to protecting against intentional adulteration will provide context as well as a starting point for rethinking training and enhancing your company’s food defense program.

Rule Summary
Overall, this rule will help to prevent wide-scale public health harm by requiring certain food companies in the United States and abroad to take steps to prevent intentional adulteration of the food supply.

FDA decided to regulate food defense similar to a Hazard Analysis and Critical Control Points (HACCP) system, which has widespread usage by food processors. While the rule has similarities to HACCP, the rule also takes some different approaches by virtue of its focus on intentional contamination/adulteration of food product verses our historical focus of unintentional contamination/adulteration. For example, instead of identifying hazards as in HACCP, firms will identify vulnerabilities. Within this new rule, as with HACCP and the Preventive Controls for Human Food rule, monitoring, corrective action, verification and periodic reanalysis of the plan is required.

Under the new rule, for the first time, both domestic and foreign food facilities are required to complete and maintain a written food defense plan that assesses their potential vulnerabilities to deliberate adulteration where the intent is to cause wide-scale public health harm. Regulated facilities now must identify and implement mitigation strategies to address these vulnerabilities, establish food defense monitoring procedures and corrective actions, verify that the system is working, ensure that personnel assigned to the vulnerable areas receive appropriate training and maintain certain records. Generally, a reanalysis is required every 3 years unless other certain criteria are met.

Training Requirements under the New Rule
Section 121.4 of the FDA Final Rule, entitled “Qualifications of Individuals Who Perform Activities under Subpart C,” delineates training requirements for facilities covered under the rule. The rule takes a tiered approach in addressing who is required to meet specific training as well as their experience requirements dependent upon the activity performed. Section 121.4 is only applicable to those individuals who perform activities found in Subpart C “Food Defense Measures.” Those activities found in Subpart C are specifically the food defense plan, vulnerability assessment, mitigation strategies that include ‘actionable process steps’ and strategies management components, food defense monitoring, food defense corrective actions, food defense verification and reanalysis. An “actionable process step” is defined as “a point, step, or procedure in a food process where a significant vulnerability exists and at which mitigation strategies can be applied and are essential to significantly minimize or prevent the significant vulnerability.”

In general, the final rule mandates all individuals who perform activities under Subpart C to be qualified through training, education or job experience, or through a combination thereof. Employees performing activities under Subpart C include temporary and seasonal personnel. Such individuals are defined in the rule as Qualified Individuals (QIs) and are not required to be employees of the establishment. Section 121.4 requires that individuals performing activities under Subpart C have certain qualifications that vary based on the activity performed. Remember that any employee who would perform job activities limited to those not found under Subpart C is excluded from the mandatory training in the rule. 

Individuals and their supervisors at actionable process steps must be QIs and have the appropriate education, training, or experience (or a combination thereof) necessary to properly implement the mitigation strategy specific to their job assignments and receive training in food defense awareness. Many firms will be able to meet these requirements using a combination of internal training and using available free courses and tools developed by regulators such as FDA and the U.S. Department of Agriculture (USDA) and/ or academia in addition to contacting outside firms for training should that be a preference. 

As part of the tiered approach, increased qualifications are required for those individuals who prepare the food defense plan, conduct a vulnerability assessment, identify and explain the mitigation strategies or conduct the reanalysis of the food defense plan. These individuals must be a QI and have successfully completed training for the specific activity at least equivalent to that received under a standardized curriculum recognized as adequate by FDA or be otherwise qualified through job experience to conduct the activities. Job experience may qualify an individual to perform any of the activities listed previously if such experience has provided an individual with knowledge at least equivalent to that provided through the standardized curriculum. It is the intent of FDA to establish a standardized training curriculum, available online, of approximately 4 hours for those individuals performing these activities with the exception of the vulnerability assessment. 

For those individuals performing a vulnerability assessment, the training will likely be more extensive. As the Hazard Analysis is vital for the HACCP plan to function as intended, as is the vulnerability assessment for a food defense plan. Conducting a vulnerability assessment is a unique and difficult challenge that requires skills in food safety, food defense and general security, along with excellent decision making and science-based analytical skills. Such a diverse background for one individual is not commonly found, especially within smaller companies. As such, this training will benefit much of the regulated industry. FDA has indicated that the curriculum designed for this activity will require multiple days; however, the course length could vary based on the vulnerability assessment method chosen.

It is important to note that Section 121.4(d) of the rule mandates that the responsibility for ensuring compliance by individuals with the rule’s requirements be clearly assigned to supervisory personnel with adequate qualifications to supervise the activities.

Training and the Importance of a Food Defense Culture
With few exceptions, there is good argument that general food defense and awareness training should be provided to all employees. Please note, however, that in the final rule, FDA does not take this approach and limits training to those activities found under Subpart C. FDA believes that it is useful to train all employees; however, the best use of resources is to train individuals at actionable process steps in food defense awareness, because that is where intentional adulteration, when intended to cause wide scale public health harm, is most likely to occur.

Many in the food industry feel one of the most critical food defense mitigation strategies is to establish a culture of food defense through corporate example, leadership, employee awareness and employee training. A food defense culture is simply one of the most vital pillars for a successful food defense plan. Widespread use of cameras in critical areas of a food operation is essential as is the concept of properly trained employees as mobile cameras, listening devices and alarms when something out of the ordinary. Employees should be instructed to be vigilant and be required to report odd or suspicious activity. Good training can help all staff to mitigate smaller scale acts of intentional adulteration as well as those intended to cause wide-scale public health harm. 

Companies must protect their facility, brand, product and their employees; however, distinguishing among overall facility security, personnel security and food defense can be a challenge. For example, who knows if a disgruntled employee may attack the food product (food defense training) or coworkers (violence in the workplace training), or seek to damage the facility (facility security training)?  Having all staff constantly vigilant of their surroundings and committed to reporting/responding to potential suspicious activity is the best defense against a disgruntled worker or a terrorist. We often hear of concerns surrounding home-grown terrorists. While often lacking sophistication, those that wish to do harm can be highly successful when they know how to blend within our culture. Employees know their coworkers, recognize those making deliveries and often many of the visitors to facilities. With proper food defense training they just may be in the best position to note atypical action and could be the only defense against someone willing to carry out criminal activity. The Department of Homeland Security has many more stringent barriers to penetrate (as indicated below in the solid rings), whereas hometown security, and indeed often facility security, has a more penetrable barrier (as noted by the single dotted ring), making nefarious actions easier to carry out, particularly by those who understand the culture and can thus better blend in.

In the illustration, the term “hometown” is used instead of the more common term of “homegrown.” The use of hometown better demonstrates the simple and unfortunate situation that there may only be localized opportunities to interfere with their intentions. In some scenarios, such local opportunities could be limited just to a vigilant employee.

It is worthwhile to note that although an act of intentional adulteration is not likely to occur in the U.S. based upon a historical perspective, violence in the workplace is much more common. Such is the example on December 2, 2015, in San Bernardino, California, where 14 people were killed and 22 were seriously injured in a terrorist attack in the workplace where a coworker and his wife targeted a San Bernardino County Department of Public Health training event and Christmas party, of about 80 employees. There are many cases of workplace violence and to repeat, having a trained vigilant staff is critical as a counter measure for more than intentional food contamination.

Training Considerations
For facilities under the new rule, staff who monitor, take corrective actions and conduct verification within vulnerable areas must receive appropriate training. This training must be specific to the tasks assigned. All training records must be maintained.  When staff fail at any of these tasks, prompt corrective action must take place and questions such as those noted below must be answered.

• Was the problem a result of inadequate training?  

• If so, what were the training deficiencies?  

• Should the task be reassigned?  

• How will such identified deficiencies be corrected?
 
Besides facility/activity-specific training, more general training, such as the excellent food defense training that has been developed by FDA and USDA, should also be provided, The FDA’s “Food Defense 101, Food Defense Awareness for the Front-line Employee,” is a great course to meet the food defense awareness requirement. State food safety agencies have also developed superb food defense materials, although unfortunately many of these training materials are often underutilized. Training must also include facility specific training for some employees, general security and company-sponsored incentive plans.

Another excellent resource that companies should strongly consider utilizing and training their employees to use to build new or enhance existing food defense programs is the FDA “Food Defense Plan Builder,” a free and downloadable software program developed by FDA for use by the food processing industry. More information on this tool can be found at www.fda.gov/Food/FoodDefense/ToolsEducationalMaterials/ucm349888.htm.

Food defense and awareness training should not be limited to a one-time occurrence. There are times where retraining may be required under the rule, such as when there is a change in production, resulting in a new mitigation strategy. In this case, affected employees and supervisors may need retraining if their responsibilities under Subpart C change. The training may be shorter than the original training but will need to be facility/activity specific. In general, refresher training for all employees is recommended.

A critical and fundamental aspect of training is the familiar “If you see something, say something.” It is vital that a culture is in place that encourages employees to be comfortable reporting something out of the ordinary and not have to worry about criticism or retaliation if a false alarm. Often overlooked, employers must remember to stress confidentiality to their staff when something is reported.

Conclusions
The “Focused Mitigation Strategies to Protect Food against Intentional Adulteration” rule protects our food against intentional adulteration where the intent of the adulteration is to cause wide-scale public health harm. As such, the rule includes some exemptions for smaller firms and the retail food sector. In the case of disgruntled employees being recruited by terrorist organizations, the many provisions of the final rule focused on protecting food against wide-scale intentional adulteration will minimize the likelihood of success. However, we must remember that someone desiring to commit intentional adulteration could bypass a more protected facility by targeting food facilities exempt from some or all the requirements.

The importance of a robust employee food defense training cannot be overemphasized. Training is a low-cost, broad mitigation strategy to minimize a facility’s vulnerability to potential acts of intentional adulteration. Food defense culture based upon a strong employee training program is simply one of the most vital pillars for a successful food defense plan.

In regard to those larger food facilities affected by the new rule, they now face a new and daunting requirement that includes some unique skill sets that differ from those typically found in the industry. The importance of a robust training program could be obscured by the new technical challenges within the rule. Doing the bare minimum training or providing lower quality training is not an area to cut corners. Effective food defense employee training is a critical part to the foundation of a successful food defense program.   
 
It is important that a food defense program not be limited to those regulated firms under the rule. Just like unintentional adulteration can have a dramatic effect on a firm’s bottom line, so would be the effects of intentional adulteration. Fortunately, a good food defense training program can be a deterrent to thwart intentional contamination. When training is coupled with utilizing the many food defense tools and checklists developed by FDA, USDA, states and academia, we can provide a strong overall food defense program to all in the food sector including very small firms while keeping expenses down.

Richard M. Ritota is an independent consultant working for EAS Consulting Group, LLC.