Tag Archives: vulnerability assessment

Melody Ge, Corvium
FST Soapbox

Compliance with the Intentional Adulteration Rule: Using FMEA for Your Vulnerability Assessment

By Melody Ge
No Comments
Melody Ge, Corvium

What is FMEA? What is a vulnerability assessment (VA)? How can these two be linked? Despite what you may think, there are similarities between these two methods. FMEA (Failure Modes and Effects Analysis) methods can be utilized to help objectively assess the vulnerable steps within your process.

After July 26, 2019, businesses other than small and very small businesses (defined by FDA) must comply with the FSMA Intentional Adulteration (IA) Rule. The rule is intended to enforce industry regulation to conduct vulnerability assessments and address proper mitigation plans to prevent any potential fraud risks within the food defense plan. For small businesses, the compliance date is July 27, 2020; for very small businesses, the compliance date is July 26, 2021.

Although the IA rule does not specify a particular method that you must use to conduct your VA and address proper mitigation plans, the following elements must be considered during your evaluation and mitigation strategy and must be implemented at each actionable step afterwards:

  • The potential public health impact (e.g., severity and scale) if a contaminant were added (21 CFR 121.130(a)(1))
  • The degree of physical access to the product (21 CFR 121.130(a)(2))
  • The ability of an attacker to successfully contaminate the product (21 CFR 121.130(a)(3))

During the 2019 Food Safety Consortium, Melody Ge will present: How to prepare ourselves in this data-driven transitioning time for the smart food safety era? | October 2 @ 10 am FMEA is a Six Sigma method widely used in operations when implementing a new process. It is a structured approach to discover potential failures that may exist within the design of a product or process. Within FMEA, the RPN (Risk Priority Number) score is used to prioritize risks and is calculated by Severity × Occurrence × Detection. RPN is a quantified number that helps you prioritize risks when determining actions. If we employ the same mentality, FMEA is a useful method in helping to identify vulnerable steps based on the risk within your process. Take a close look at how the RPN is generated; the following three components are also important during the vulnerability assessment.

Severity or the potential public health impact (e.g., severity and scale) if a contaminant were added.
Severity is identified when considering the consequence of when a processing step goes out of control; or thinking about the severity of the health impact. We can consider those impacts or consequences using four common categories:

  • Biological contaminants
  • Chemical contaminants
  • Physical contaminants
  • Intentional adulteration for economic gain contaminants

Occurrence or the degree of physical access to the product.

Occurrence is identified when considering how frequently a process step is expected to go out of defined controls. Is it once a week or once a month? Depending on how often the step goes out of defined controls, this will trigger different action steps as well as mitigation plans.

Detection or the ability of an attacker to successfully contaminate the product.

Detection is considered by how easy it can be detected when the failure occurs. For example, within the food production operation, mixing steps is relatively easier than a CIP step to be detected. More references could be found in FDA’s definition of KAT (Key Activity Types, as discussed in the draft guidance, “Mitigation Strategies to Protect Food Against Intentional Adulteration”), such as:

  • Bulk and liquid receiving and storage
  • Liquid storage and handling
  • Secondary ingredient handling
  • Mixing and similar activities

Once the RPN is identified, then the vulnerable steps can be sorted based on the RPN. To utilize this approach, Table 1 provides a template to be considered using FMEA for the vulnerability assessment.

Process Step Description Is it KAT? (Y/N) RPN Action Process Step Mitigation Strategy Explanation
Sev Occ Det RPN
Table 1: Determine the vulnerable steps (for reference)

As IA rules regulate, a mitigation plan must be generated once a vulnerable step is identified. The intention of the plan shall ensure those risks identified are mitigated and controlled so that the final finished products are not impacted or contaminated. One tip to begin this process is to start with reviewing your current control plan for potential food safety risks. As FSMA Preventive Controls are fully implemented, all food plants shall have a food safety plan in place with validated control plans that are intended to reduce risks for potential physical, chemical, biological and adulteration for economic gain. Sometimes, these risks are highly associated with potential vulnerable steps for intentional adulteration, especially those processing steps associated with potential economic gain hazards. If those controls are not working properly, then we can seek out other mitigation plans. Nevertheless, regardless of what steps are taken, they have to be validated to show that the IA risks are effectively mitigated. Monitoring and verification shall be conducted as well once the mitigation plan is implemented.

Of course, like all food safety management systems, every food plant should have its own designated plans based on the products being produced, operations implemented and the nature of the production. Ultimately, it will be your choice to find an effective method that fits your production culture. However, the intention should always be in compliance with the IA rules: Identify the vulnerable steps within the process, and conduct mitigation plans to control the risks of intentional adulteration.

Vulnerability assessment

Protecting Food Against Intentional Adulteration: The Vulnerability Assessment (Part One)

By Debby L. Newslow
2 Comments
Vulnerability assessment

FDA, as part of FSMA, released its rule titled “Protecting Food Against Intentional Adulteration” on May 27, 2016. This rule was proposed in 2013. FDA received and responded to 200+ comments prior to its final release.

FDA states that this rule “is aimed at preventing intentional adulteration from acts intended to cause wide-scale harm to public health, including acts of terrorism targeting the food supply. Such acts, while not likely to occur, could cause illness, death, [and] economic disruption of the food supply absent mitigation strategies.”1

The rule requires a documented “Food Defense Plan” that at a minimum includes the following:

  • Vulnerability assessment
  • Mitigation strategies
  • Procedures for food defense monitoring
  • Food defense corrective action procedures
  • Food defense verification procedures
  • Records confirming implementation, maintenance and conformance to the defined requirements
  • Evidence of effective training

As a food safety professional with more than 30 years in the industry, reviewing this rule brought back many memories. These memories combined with information gained from a recently completed Food Defense/ Crisis Management workshop presented by Rod Wheeler really set my brain into motion.2

Years ago, industry focused on crisis management and product recall. Requirements included having a crisis management team that was led by associates representing both upper and middle management. In addition, most programs included the following:

  • Posted identification of the crisis management team (i.e., pictures, phone numbers, etc.)
  • Specific training for receptionist and guards
  • Mock crisis exercises (i.e., fire drills)
  • Planned crisis calls to the operation’s direct incoming phone numbers (i.e., receptionist and guards)
  • Mock recalls (from supplier through finished product and distribution)
  • Security inspections which may now be considered the pre-cursor to today’s “Vulnerability Assessment”

With the introduction of the GFSI approved schemes (FSSC 22000, BRC, SQF, GlobalG.A.P., Primus, etc.), requirements for crisis management, emergency preparedness, security programs, food defense training and continuity planning gained an increase focus. Do any or all of these programs meet the requirement for a “vulnerability assessment”?

In the 2013 publication, Food Safety Management Programs, this subject-matter chapter was titled “Security, Food Defense, Biovigilance, and Bioterrorism (chapter 14)”.3 An organization must identify the focus/requirements that are necessary for its operation. This decision may relate to many different parameters, including the organization’s size, design, location, food sectors represented, basic GMPs, contractor and visitor communication/access, traceability, receiving, and any other PRP programs related to ensuring the safety of your product and your facility. Requirements must be defined and associates educated to ensure that everyone has a strong and effective understanding of the requirements and what to do if a situation or event happens.

Confirming the security of a facility has always been a critical operational requirement. Many audits have been performed that included the following management statement: “Yes, of course, all the doors are locked. Security is achieved through key cards or limited distribution of door keys, thus no unwanted intruder can access our building.” This statement reminds me of a preliminary assessment that I did not too long after the shootings at a Pennsylvania manufacturer in September of 2010. The organization’s representor and myself were walking the external parameter of a food manufacturer at approximately 7:30 PM (still daylight). We found two doors (one in shipping and one accessing the main office), with the inside door latch taped so that the doors were not secure. The tape was not readily evident. The doorknob itself was locked, but a simple pull on knob opened the door. Our investigation found that a shipping office associate was waiting for his significant other to bring his dinner and was afraid that he would not be at his desk when she arrived. An office associate admitted that that door had been fixed to pull open without requiring a key several months earlier because associates frequently forgot their keys and could not gain access to start work.

Debby Newslow Debby Newslow will present ” Sanitary Transportation for Human & Animal Food – Meeting the new FDA Requirements” at the Food Safety Supply Chain Conference  | June 5–6, 2017 | Attend in Rockville, MD or via webcast | LEARN MORE

We also observed a large overhead door adjacent to the boiler room along the street side of the facility open, allowing direct access to the processing area by passing through the boiler room and then the maintenance shop. It was stated that the door had been opened earlier in the day waiting for the delivery of new equipment. No one at the time knew the status of the shipment or why the door was still open.

Finding open access to facilities is becoming more and more common. A formal vulnerability assessment is not necessary to identify unsecured doors (24/7) in our facilities. Education and due diligence are excellent tools for this purpose.

Another frequently identified weakness is with organization’s visitor and contractor sign-in prerequisite programs. What type of “vulnerability” are we creating for ourselves (false confidence) with these programs? Frequently these programs provide more questions than answers:

  • Does everyone really sign in?
  • What does signing the visitor log mean?
  • Are visitors required to show identification?
  • Are the IDs actually reviewed and if so, what does this review include?
  • Who is monitoring visitors and contractors and are they trained?
  • Do all contractors have to sign the log or are they allowed to access the building at different locations?
  • Do those contractors who make frequent or regular trips have their own badges and/or keys (keycards) so they don’t have to take the time to sign-in (i.e., pest control, uniform supplier vending services)?
  • How are contractor badges controlled?
  • Are visitors required to be accompanied during the visit or does it depend on the visitor and whom they are visiting?
  • Are visitors and contractors trained in company requirements?
  • Do visitors and contractors have an identifying item to alert your associates of their status (i.e., visitor badge, visitor name badge, specifically colored bump cap, colored smock, etc.)?
  • How are truck drivers monitored? Do they have a secured room for them or do they have complete access to the facility to access the restrooms and breakroom?
  • How are terminated associates or associates that have voluntarily left the company controlled?
    • Can these associates continue to access the facility with keys, access cards, or just through other associates (i.e., friends or associates that did not know that they were no longer an employee)?
  • How many more questions can there be?

Continue to page 2 below