In order to protect the public from a wide-spread, intentional, malicious contamination of the food supply, the Food Safety Modernization Act required the FDA to publish and enforce a new food defense or “IA” rule. This new regulation (21 CFR 121) is now in effect for companies having more than 500 employees, with inspections beginning March, 2020. The FDA rule requires all facilities that process and/or hold liquid foods to develop and implement a written food defense plan (see 21 CFR 121.5 for exemptions).
Similar to the HACCP principle of hazard analysis, the IA rule requires a written vulnerability assessment (VA) as a key component of the food defense plan. Unlike an assessment of unintentional food safety hazards, the VA is a systematic evaluation of process steps to identify and rank vulnerabilities to intentional adulteration. The FDA defines vulnerability as “the susceptibility of a point, step, or procedure in a facility’s food process to intentional adulteration.” Although the IA rule was originally developed to address terrorist attacks on our food supply, the VA must also consider vulnerability to an “inside attacker”, such as a disgruntled employee. The goal of the VA is to flesh out significant vulnerabilities: susceptibilities in process lines or areas that “if exploited could reasonably be expected to cause wide spread public health harm.” These are the areas or equipment where protective measures, called “mitigation strategies”, will be needed.
How is a VA conducted? First off, the VA must be facilitated by a trained “qualified individual” who has been educated in appropriate VA methods with standardized training materials recognized by FDA, or has equivalent job experience. There are three methods provided in the current FDA/FSPCA curriculum: 1) Key Activity Types (KAT), 2) Three Element method, and 3) the Hybrid Approach (KAT + 3 elements). Each of these methods evaluates potential public health impacts, degree of physical access to the product, and ability of an attacker to successfully contaminate product. The possibility of an inside attacker must also be considered.
Each product type or group requires a VA. To get started, it is best to pull out an existing HACCP process flow chart for your production line(s). Every one of the process steps must then be evaluated with one or more of the three VA methods.
To choose the most appropriate VA method for your facility, it is highly recommended that a designated person attend a training program or take an on-line course that uses the standardized or equivalent training materials. In addition, the FDA has an excellent guidance document which details how to use each of these methods. See: “Mitigation Strategies to Protect Against Intentional Adulteration: Guidance for Industry.” Revised Draft Guideline. March, 2019. FDA, CFSAN (available at fda.gov).
In our opinion, the KAT method is the easiest to learn and use. Simply stated, you just filter your process flow chart through the four KAT’s to see which of the process steps match one of the four KAT’s: bulk liquid receiving and loading, liquid storage and handling, secondary ingredient handling, and mixing and similar activities. If none of the steps match these KAT’s, you don’t have any actionable process steps that will require mitigation strategies and you are done with the VA! The three element method is complex, time consuming, and somewhat onerous to the food industry. Calculations may be required to evaluate each process step, along with scoring and ranking. The hybrid approach offers a few more benefits, such as having a more in-depth method to evaluate a process step that may have mapped to a KAT, but has other factors which would relegate it to a non-significant vulnerability. It can also be time consuming to conduct.
There are both on-line and in-person courses to learn how to conduct VA’s using KAT, three element, or hybrid methods. Look for a training program that uses standardized or equivalent materials to meet the QI educational requirement for VA (and also for mitigation strategies!). Food Safety Northwest offers a Practical Food Defense Workshop, that teaches the KAT method using FDA-equivalent training materials, along with a mitigation strategies module.