FDA’s Ryan Newkirk, left, and Jon Woody work to prevent and defend against intentional contamination of food.

As part of the Food Safety Modernization Act (FSMA), the Food and Drug Administration issued on May 27, 2016, a final rule to require domestic and foreign food facilities, with some exceptions, to address hazards that may be introduced with the intention to cause wide-scale harm to public health.

These food facilities are required to identify significant vulnerabilities and take steps to minimize or prevent them. The first compliance date is July 26, 2019.

Ryan Newkirk, senior advisor for intentional adulteration with the Food Defense and Emergency Coordination Staff at FDA, and Jon Woody, director of the Food Defense and Emergency Coordination Staff, talk about the new rule and what the FDA is doing to support industry compliance.

Q: Can you tell us in a nutshell what the rule is all about?

Newkirk:  Sure. The purpose of the rule is to protect food from a person or group of people who are intentionally doing something to the food to either cause illness or death on a large scale. The rule does this by requiring that certain facilities develop and implement a food defense plan.  It applies both to domestic facilities and foreign facilities that export food to the United States.

Q: Why isn’t adulteration that is economically motivated, such as substituting an ingredient for something cheaper, included in this rule?

Newkirk:  Economically motivated adulteration is very different because the goal is financial gain. We decided that addressing economically motivated adulteration worked better under the preventive controls framework, which focuses on hazards that are known or reasonably foreseeable. So the final rules on preventive controls for human and animal food address economically motivated adulteration if it can affect the safety of the food. Economically motivated adulteration that affects product integrity or quality, but not food safety, is out of the scope of those rules. Substitution for something cheaper could result in misbranding, which is subject to the provisions of the Federal Food, Drug, and Cosmetic Act.

Ryan Newkirk

Q: What does a food defense plan consist of?

Newkirk: There are several main components to the plan. First, facilities must conduct a vulnerability assessment, which means finding the points in their processes that pose the greatest risk for intentional adulteration. Second, facilities must put in place mitigation, or preventive, strategies to address these vulnerabilities. Third, a system must be put in place for food defense monitoring, food defense corrective action, and food defense verification, which together ensure the system is working as intended to address the vulnerabilities. Fourth is recordkeeping.  Finally, there are training requirements. Personnel, and their supervisors, working at the most vulnerable points in a facility are required to take food defense awareness training and to have the education, training, or experience to properly implement mitigation strategies. In addition, preparing the food defense plan, conducting vulnerability assessments, identifying mitigation strategies, and engaging in reanalysis activities must be done or overseen by personnel with additional training or experience.

Q: Are there certain foods that we are targeting with these food defense plans?

Newkirk:  No, on the contrary. One food is not inherently more at risk than another. It’s the processes that are the drivers of vulnerability.

Q: Can you give me an example of a vulnerability?

Newkirk:  Yes. Examples include an open access hatch on a large, liquid food storage silo or a very large mixing vat that is open without a lid. But keep in mind that these aren’t automatically vulnerabilities—it depends on the assessment carried out by the facility.

Q: I understand that the main components of the rule stem from more than 15 years of working with industry. Does that mean the requirements are familiar to industry?

Woody:  For the most part, yes. We began focusing on food defense back in 2001, working with other federal and state agencies that protect food. Assessing vulnerabilities and putting in place preventive measures to address them are familiar steps to the food industry. A presidential directive was issued in 2004 to require FDA and the U.S. Department of Agriculture to conduct food defense vulnerability assessments with industry. So we’ve had some time to learn what works and what doesn’t, and industry has played a major role in that. In fact, the main requirements of the rule come from our collaborative efforts with industry.

What’s new is that this is the first time that industry is required to take these steps—that part is novel. Up to now, food defense activities have been voluntary.

Q: If the major requirements are familiar, why have some members of the industry voiced concerns about this regulation?

Newkirk:  There is concern that the costs of complying with the rule are too high when considering the remote chance of an incident happening. We know that the likelihood of an incident happening is low, and thank goodness it’s low. But it’s not zero. And a single act could lead to wide-spread harm, causing illness, death and economic disruption of the food supply. If you look at the largest outbreaks of foodborne illness, you can see what could potentially happen.

We are aware that industry has many questions regarding implementation of the rule in their facilities and the costs associated with implementation. That is why we are working on draft guidance that will provide additional information to help industry comply with the rule. We believe that the information contained in the guidance will help address many of the concerns raised by industry.

Jon Woody

Q: How are you responding to these concerns about costs?

Woody:  We’ve built as much flexibility into the rule as possible to keep costs down. This is by no means a “one size fits all” regulation. For example, we don’t specify what method must be used to conduct the vulnerability assessment. Any method is acceptable as long as it has certain elements. For example, we have identified four key activity types that FDA considers significant vulnerabilities. They are bulk liquid receiving and loading, liquid storage and handling, secondary ingredient handling, and mixing and similar activities. Instead of conducting a broader vulnerability assessment, a facility can identify actionable process steps for these specific activity types.

And we do not specify what preventive steps must be used. Companies have significant flexibility in choosing which mitigation strategies are most appropriate for them. Several years ago, we made available a free, Mitigation Strategies Database that contains examples of preventive measures.

Additionally, there is significant flexibility built into the requirements related to food defense monitoring, food defense corrective actions, food defense verification, and training.

Q: Did you visit any facilities to learn how food defense is being handled now?

Woody: Because of our long history of working on food defense, we’ve carried out many site visits —even before FSMA was enacted. We’ve seen many different types of facilities and products. Additionally, since the final rule published, we’ve continued with site visits, and our discussions with industry regarding their current food defense programs.

Q: Are there any exemptions to the requirements?

Newkirk: The law requires us to focus on the greatest risks and the areas of most concern, so we have been able to provide some exemptions to minimize the burden on industry. The rule is designed to primarily cover large companies whose products reach many people, exempting smaller companies. For example, the requirements do not apply to very small businesses averaging less than $10 million in sales per year. They do have to document that they are exempt, however. There are also other exemptions, including the holding of food, except for liquid food, and for farms.

Q: When do facilities have to comply with the requirements?

Newkirk:  Larger businesses—those that are not considered small or very small businesses under the rule—have until July 26, 2019 to comply with the requirements. Small businesses, which employ fewer than 500 people, have until July 27, 2020 to comply. Very small businesses are exempt from most of the requirements, but by July 26, 2021, they must document that they meet the requirement to be exempt. About 9,800 food facilities are covered.

Q: When can industry expect to see guidance documents? 

Newkirk: In August, we published a small entity compliance guide, and we are now working on the other guidance documents on topics such as conducting a vulnerability assessment; identifying and implementing mitigation strategies; and writing procedures for food defense monitoring, corrective actions and verification. We believe that the information contained in these guidance documents will help address many of the concerns raised by industry.

Q: What are your plans for training?

Woody: We need training for both industry and inspectors who will be checking to make sure the requirements are met. The Intentional Adulteration Subcommittee within the Food Safety Preventive Controls Alliance is developing food defense training resources for industry and inspectors alike. Training will include a combination of online and instructor-led formats, and we expect it to be ready by summer 2018. We’ve already initiated a series of webinars that can be viewed online  . And we are updating the Food Defense Plan Builder software, which now exists under our voluntary program.

Q: How soon after the compliance dates are reached will you begin inspecting?

Woody: When the compliance dates come, we first plan to do “quick check” inspections, which will be combined with other food safety inspections already scheduled. Inspectors will simply evaluate the food defense plans to make sure the required components are there. Our second stage of inspections will be more comprehensive and requires more detailed training for inspectors. You may have heard the phrase “educate before and while we regulate.” That certainly holds true for the intentional adulteration requirements. We believe a collaborative approach is the best approach for good compliance with the rule requirements.

For more information

(To sign up for a free subscription to Food Safety News, click here.)