whose standards do you pay attention to? food defense in

Whose Standards Do You Pay

Attention To?

Food Defense in the Global

Marketplace

Craig Henry Ph.D. – AERS Director, Deloitte & Touche LLP

December 6, 2012

Copyright © 2012 Deloitte Development LLC. All rights reserved.

• Why is food defense important?

• Food defense program standards?

• How can my company address food

defense?

• What Materials and Information are

Available to Assist Me?

Agenda

Food defense program standards?

Which standards scheme to adopt? “Once certified, accepted everywhere”


FDA, FSIS, GFSI, PAS 96, ISO, the customer’s, YOUR’S ????

Whose standards should you use?

FSIS -

General

Food

Defense

Plan

http://www.fsis.

usda.gov/PDF/G

eneral-Food-

Defense-Plan-9-

3-09%20_2_.pdf

FDA –

Food

Defense

http://www.f

da.gov/Food/

FoodDefens

e/FoodDefen

sePrograms/

default.htm -

British Standards

Industry PAS96

This Publicly Available

Specification (PAS) was

developed by the Centre for the

Protection of National

Infrastructure (CPNI) in

collaboration with The British

Standards Institution (BSI) in

2008. The original edition made

use of preventative strategies

within the World Health

Organisation guidance on the

Terrorist Threat to Food [1] which

was revised in May 2008. This

new 2010 edition of PAS 96 has

been reviewed by relevant

stakeholders and amendments

made to ensure its continued

relevance and accuracy.

GFSI

Schemes

i.e.)

SQF™

BRC™

FSSC22000

™

GlobalGAP™

Primus™

IFS™


FDA Food Defense Tools and Guidance

http://www.fda.gov/Food/FoodDefense/FoodDefenseProg

rams/default.htm


A. Develop. The establishment develops a written plan by performing a

vulnerability assessment. As part of the assessment the establishment:

− looks for vulnerable points at the establishment,

− determines what the risk factor is for each point,

− develops defense measures at each point that it has identified as high

risk, and

− creates a written plan to implement defense measures.

Defense measures are actions taken to build barriers or shields around vulnerable

areas to prevent intentional product adulteration. The defense measures that the

establishment develops can be physical barriers such as locks, fences, and

cameras, or the measures can be changes in procedures such as limited access,

escorting visitors, or supervising contract employees.

FSIS - ELEMENTS OF A FUNCTIONAL FOOD

DEFENSE PLAN


B. Implement. The food defense plan is implemented when the defense

measures identified in the plan are in place and used as intended.

C. Test. The establishment tests the written plan by monitoring periodically

to evaluate the effectiveness of its defense measures. Examples for tests or

drills used may include, but are not limited to:

− making unannounced entrances at various perimeter checkpoints,

− checking plant employee ID badges,

− checking locks on doors, windows, storerooms or water and ice facilities,

− performing a mock recall, or

− testing lab or storeroom inventory procedures.


DEFENSE PLAN


D. Assess. The establishment assesses the plan by reviewing the plan

and revising it as necessary whenever new risks are discovered. For

example, certain changes in the production process, contracted services,

and production lines may be assessed to determine whether new defense

measures should be added to the food defense plan.

E. Maintain. The establishment maintains its plan by ensuring that the

defense measures it implements continue to be effective. For example, an

establishment may purchase materials or equipment designed for food

defense, make repairs, or train employees as necessary for the plan to be

successfully implemented.

NOTE: There are no regulatory requirements for an establishment to

develop a plan or to include the elements above in its food defense plan.

However, FSIS strongly encourages establishments to maintain a food

defense plan.


DEFENSE PLAN


FSIS General Food Defense Plan

• Available online in

English, Spanish,

Chinese, Vietnamese,

and Korean

• http://www.fsis.usda.gov/PDF/Ge

neral-Food-Defense-Plan-9-3-

09%20_2_.pdf

9


Inside Security Measures, (Examples: signs,

observations, restricted access)

Personnel Security Measures (Examples: check

references, use visitor log or sign-in, or check IDs)

Incident Response Security Measures (Examples:

reference your emergency plan, security plan or other)

FSIS – GENERAL FOOD DEFENSE PLAN


2.2 Slaughter/Processing Area Security

a. Access to live animals, ingredients, and packaged product is restricted

b. Access to animal handling areas and/or carcass coolers is controlled

c. Access to process control equipment such as ovens, mixers is restricted

d. Ingredients are examined for possible tampering

e. Records ensure traceability for one step backward, one step forward, or

both

f. Other

FSIS – GENERAL FOOD DEFENSE PLAN (Inside

Security Measures example)


FSIS Food Defense Guidance

FSIS - food defense guidance for food processors,

importers, transporters, distributors, and

consumers.

12


1. Malicious, ideologically motivated threats to food and food

supply

2. Broad themes of food defense

3. Presumptions

4. Threat Assessment Critical Control Point “TACCP”

5. Assessing the threat

6. Assuring personnel security

7. Controlling access to premises

8. Controlling access to services

9. Secure storage of transport vehicles

10. Controlling access to materials

11. Controlling access to processes

12. Contingency planning for recovery from attack

13. Audit and review of food defense procedures

© BSI March 2010 , ISBN 978 0 580 70039 2 , ICS 67.020

PAS 96:2010, Defending food and drink

How can my company address food defense?

Copyright © 2012 Deloitte Development LLC. All rights reserved. 15

Practical Food Defense Summary

Evaluate an establishment‘s current food defense

programs for adequacy compared with commercial

standards, FDA, DHS and/or USDA-FSIS guidance

Utilize the available food defense planning tools available

through DHS, FDA and USDA

Conduct a CARVER + Shock analysis of products and

facilities

Conduct a practical assessment of facility security

systems and procedures for proper execution and

effectiveness

Assess the upstream food defense programs for supply

chain exporting to the US



Establish an incident command structure

Crisis management teams should be very familiar local

and regional fusion centers to enhance crisis

communications

Establish rapport with regulatory agencies regarding food

defense requirements and procedures

Engage with the Food and Ag Sector Coordinating

Council to maintain a current knowledge base and obtain

factual information


Food Defense/Security Assessment

1.Many companies have not taken advantage of the Department of

Homeland Security Protective Security Advisor (PSA) program to

obtain a comprehensive assessment of their facility security

measures.

2.Consider DHS Protective Security Advisory tools to characterize

facility risk.

3.The PSA’s are not food subject matter specialists so you should

seek out appropriate assistance to fully develop a comprehensive

food defense program.

Employee Training and Awareness

1. Training materials are available for supervisors and line

employees to educate and raise awareness as an additional

layer of protection.

About Deloitte

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of

member firms, each of which is a legally separate and independent entity. Please see www.deloitte.com/about for a detailed

description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Please see www.deloitte.com/us/about

for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest

clients under the rules and regulations of public accounting.


Member of Deloitte Touche Tohmatsu Limited

Craig Henry Ph.D.

AERS Director, Deloitte &

Touche LLP

Food and Product Safety

[email protected]

443-676-7463

http://www.deloitte.com/about

http://www.deloitte.com/us/about

mailto:[email protected]

Whose Standards Do You Pay

Attention To?

Food Defense in the Global

Marketplace

Craig Henry Ph.D. – AERS Director, Deloitte & Touche LLP

December 6, 2012


• Why is food defense important?

• Food defense program standards?

• How can my company address food

defense?

• What Materials and Information are

Available to Assist Me?

Agenda

Food defense program standards?

Which standards scheme to adopt? “Once certified, accepted everywhere”


FDA, FSIS, GFSI, PAS 96, ISO, the customer’s, YOUR’S ????

Whose standards should you use?

FSIS -

General

Food

Defense

Plan

http://www.fsis.

usda.gov/PDF/G

eneral-Food-

Defense-Plan-9-

3-09%20_2_.pdf

FDA –

Food

Defense

http://www.f

da.gov/Food/

FoodDefens

e/FoodDefen

sePrograms/

default.htm -

British Standards

Industry PAS96

This Publicly Available

Specification (PAS) was

developed by the Centre for the

Protection of National

Infrastructure (CPNI) in

collaboration with The British

Standards Institution (BSI) in

2008. The original edition made

use of preventative strategies

within the World Health

Organisation guidance on the

Terrorist Threat to Food [1] which

was revised in May 2008. This

new 2010 edition of PAS 96 has

been reviewed by relevant

stakeholders and amendments

made to ensure its continued

relevance and accuracy.

GFSI

Schemes

i.e.)

SQF™

BRC™

FSSC22000

™

GlobalGAP™

Primus™

IFS™


FDA Food Defense Tools and Guidance

http://www.fda.gov/Food/FoodDefense/FoodDefenseProg

rams/default.htm


A. Develop. The establishment develops a written plan by performing a

vulnerability assessment. As part of the assessment the establishment:

− looks for vulnerable points at the establishment,

− determines what the risk factor is for each point,

− develops defense measures at each point that it has identified as high

risk, and

− creates a written plan to implement defense measures.

Defense measures are actions taken to build barriers or shields around vulnerable

areas to prevent intentional product adulteration. The defense measures that the

establishment develops can be physical barriers such as locks, fences, and

cameras, or the measures can be changes in procedures such as limited access,

escorting visitors, or supervising contract employees.


DEFENSE PLAN


B. Implement. The food defense plan is implemented when the defense

measures identified in the plan are in place and used as intended.

C. Test. The establishment tests the written plan by monitoring periodically

to evaluate the effectiveness of its defense measures. Examples for tests or

drills used may include, but are not limited to:

− making unannounced entrances at various perimeter checkpoints,

− checking plant employee ID badges,

− checking locks on doors, windows, storerooms or water and ice facilities,

− performing a mock recall, or

− testing lab or storeroom inventory procedures.


DEFENSE PLAN


D. Assess. The establishment assesses the plan by reviewing the plan

and revising it as necessary whenever new risks are discovered. For

example, certain changes in the production process, contracted services,

and production lines may be assessed to determine whether new defense

measures should be added to the food defense plan.

E. Maintain. The establishment maintains its plan by ensuring that the

defense measures it implements continue to be effective. For example, an

establishment may purchase materials or equipment designed for food

defense, make repairs, or train employees as necessary for the plan to be

successfully implemented.

NOTE: There are no regulatory requirements for an establishment to

develop a plan or to include the elements above in its food defense plan.

However, FSIS strongly encourages establishments to maintain a food

defense plan.


DEFENSE PLAN


FSIS General Food Defense Plan

• Available online in

English, Spanish,

Chinese, Vietnamese,

and Korean

• http://www.fsis.usda.gov/PDF/Ge

neral-Food-Defense-Plan-9-3-

09%20_2_.pdf

28


Inside Security Measures, (Examples: signs,

observations, restricted access)

Personnel Security Measures (Examples: check

references, use visitor log or sign-in, or check IDs)

Incident Response Security Measures (Examples:

reference your emergency plan, security plan or other)

FSIS – GENERAL FOOD DEFENSE PLAN


2.2 Slaughter/Processing Area Security

a. Access to live animals, ingredients, and packaged product is restricted

b. Access to animal handling areas and/or carcass coolers is controlled

c. Access to process control equipment such as ovens, mixers is restricted

d. Ingredients are examined for possible tampering

e. Records ensure traceability for one step backward, one step forward, or

both

f. Other

FSIS – GENERAL FOOD DEFENSE PLAN (Inside

Security Measures example)


FSIS Food Defense Guidance

FSIS - food defense guidance for food processors,

importers, transporters, distributors, and

consumers.

31


1. Malicious, ideologically motivated threats to food and food

supply

2. Broad themes of food defense

3. Presumptions

4. Threat Assessment Critical Control Point “TACCP”

5. Assessing the threat

6. Assuring personnel security

7. Controlling access to premises

8. Controlling access to services

9. Secure storage of transport vehicles

10. Controlling access to materials

11. Controlling access to processes

12. Contingency planning for recovery from attack

13. Audit and review of food defense procedures

© BSI March 2010 , ISBN 978 0 580 70039 2 , ICS 67.020

PAS 96:2010, Defending food and drink

How can my company address food defense?



Evaluate an establishment‘s current food defense

programs for adequacy compared with commercial

standards, FDA, DHS and/or USDA-FSIS guidance

Utilize the available food defense planning tools available

through DHS, FDA and USDA

Conduct a CARVER + Shock analysis of products and

facilities

Conduct a practical assessment of facility security

systems and procedures for proper execution and

effectiveness

Assess the upstream food defense programs for supply

chain exporting to the US



Establish an incident command structure

Crisis management teams should be very familiar local

and regional fusion centers to enhance crisis

communications

Establish rapport with regulatory agencies regarding food

defense requirements and procedures

Engage with the Food and Ag Sector Coordinating

Council to maintain a current knowledge base and obtain

factual information


Food Defense/Security Assessment

1.Many companies have not taken advantage of the Department of

Homeland Security Protective Security Advisor (PSA) program to

obtain a comprehensive assessment of their facility security

measures.

2.Consider DHS Protective Security Advisory tools to characterize

facility risk.

3.The PSA’s are not food subject matter specialists so you should

seek out appropriate assistance to fully develop a comprehensive

food defense program.

Employee Training and Awareness

1. Training materials are available for supervisors and line

employees to educate and raise awareness as an additional

layer of protection.

About Deloitte

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of

member firms, each of which is a legally separate and independent entity. Please see www.deloitte.com/about for a detailed

description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Please see www.deloitte.com/us/about

for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest

clients under the rules and regulations of public accounting.


Member of Deloitte Touche Tohmatsu Limited

Craig Henry Ph.D.

AERS Director, Deloitte &

Touche LLP

Food and Product Safety

[email protected]

443-676-7463

http://www.deloitte.com/about

http://www.deloitte.com/us/about

mailto:[email protected]

whose standards do you pay attention to? food defense in

Documents