The FSMA final rule on intentional adulteration, entitled “Mitigation Strategies to Protect Food against Intentional Adulteration” (IA rule), 21 C.F.R. Part 121, was published in May, 2016. The rule is designed to address hazards that may be intentionally introduced to foods, including by acts of terrorism, with the intent to cause wide-spread harm to public health.
The IA rule requires the food industry to implement risk-reducing strategies for processes in food facilities that are significantly vulnerable to intentional adulteration. Under the rule, food facilities must develop and implement a food defense plan that identifies vulnerabilities and mitigation strategies for those vulnerabilities. Several facilities are exempt from the rule, including very small businesses (they must document that they meet the criteria, i.e., sales and other fees totally less than 10 million dollars annually). The requirements also do not apply to the packing, re-packing, labeling or relabeling of food where the immediate container in contact with food remains intact, and to activities of a farm subject to the standards for produce safety. Also exempt is the holding of food, except holding of food in liquid storage tanks. The first compliance date (for companies with 500 or more employees) is July 26, 2019.
On June 19, 2018, FDA announced the availability of a draft guidance regarding the implementation of the requirements of the IA rule. The 94-page document is only the first installment of the guidance. FDA indicated that two more installments will follow.
This first installment of the draft guidance includes chapters on:
- the components of the food defense plan;
- how to conduct vulnerability assessments using the key activity type method;
- how to identify and implement mitigation strategies; and
- food defense monitoring requirements.
As described in the draft guidance, a facility must perform a vulnerability assessment for each type of food. This assessment must consider three issues:
- The potential public health impact if a contaminant were added intentionally,
- The degree of physical access to the product; and
- The ability of an attacker (including an employee) to successfully contaminate the product.
FDA used CARVER + Shock, an adapted military targeting tool, to assess vulnerabilities of the food and agriculture sector. (CARVER is an acronym for six attributes used to evaluate the attractiveness of a target for attack: Criticality, Accessibility, Recuperability, Vulnerability, Effect, and Recognizability) Based on FDA’s own analysis of 50 vulnerability assessments (VAs), FDA found that three CARVER + Shock Elements (Criticality, Accessibility, and Vulnerability) were the most important to consider when conducting facility-specific VAs. In addition, the Agency identified four “key activity types” (KATs) which consistently ranked as the most vulnerable to intentional adulteration intended to cause wide scale public health harm: bulk liquid receiving and loading, liquid storage and handling, secondary ingredient handling, and mixing and similar activities. The guidance discusses these KATs in detail.
FDA recommends that, using the KAT method, a company evaluate each point, step, or procedure in its facility to determine whether the activities at the point, step, or procedure fit within one or more of the KATs. Such steps would be actionable steps that require mitigation strategies. If a facility determines that there are no actionable processing steps, it must document this and no further action is required. The guidance uses the example of processing of smooth peanut butter as illustration of the KAT method to perform a VA.
Once actionable processing steps have been identified, the facility must develop mitigation strategies. The mitigation strategies must be identified in the food defense plan. FDA expects that mitigation strategies usually will focus on limiting physical access and reducing the opportunity of a successful attack/contamination of a food. The guidance discusses several mitigation strategies to accomplish this. FDA provides several scenarios and discusses the requirement to monitor whether mitigation strategies are working as intended..
As mentioned earlier, this draft guidance is only the first installment and, thus, the document is incomplete. FDA has indicated that the second installment will focus more specifically on VAs and training requirements, and the third installment will include greater detail on corrective action, verification, reanalysis, and recordkeeping requirements. FDA plans to hold a public meeting on the draft guidance after the second installment has been released later in 2018.
Comments should be submitted by December 17, 2018. Presumably, by that time the two remaining installments will have been released.