U.S. flag An official website of the United States government
  1. Home
  2. Food
  3. Resources for You (Food)
  4. Conversations with Experts on Food Topics
  5. Protecting the Food Supply from Intentional Adulteration, such as Acts of Terrorism
  1. Conversations with Experts on Food Topics

Protecting the Food Supply from Intentional Adulteration, such as Acts of Terrorism

A Conversation with Ryan Newkirk and Jon Woody

Ryan Newkirk (at left in above photo and top right), Senior Advisor for Intentional Adulteration with the Food Defense and Emergency Coordination Staff, and Jon Woody, Food Defense and Emergency Coordination Staff

Conversation with Ryan Newkirk and Jon Woody

As part of the FDA Food Safety Modernization Act (FSMA), the Food and Drug Administration (FDA) issued on May 27, 2016 a final rule to require domestic and foreign food facilities, with some exceptions, to address hazards that may be introduced with the intention to cause wide-scale harm to public health.  These food facilities are required to identify significant vulnerabilities and take steps to minimize or prevent them. The first compliance date for the largest facilities is July 26, 2019.

Ryan Newkirk, Senior Advisor for Intentional Adulteration with the Food Defense and Emergency Coordination Staff at FDA and Jon Woody, Director, Food Defense and Emergency Coordination Staff, talk about the rule and what the FDA is doing to support industry compliance, including the release of two installments of a draft guidance which together are intended to clarify some of the most important  requirements of the IA rule and assist FDA and industry with developing a common understanding of the expectations for implementation.

Q: Can you tell us in a nutshell what the rule is all about?

Newkirk:  Sure. The purpose of the rule is to protect food from a person or group of people who are intentionally doing something to the food to either cause illness or death on a large scale. The rule does this by requiring that certain facilities develop and implement a food defense plan.  It applies both to domestic facilities and foreign facilities that export food to the United States.

Q: What does a food defense plan consist of?

Newkirk: There are several main components to the plan. First, facilities must conduct a vulnerability assessment, which means finding the points in their processes that pose the greatest risk for intentional adulteration. Second, facilities must put in place mitigation, or preventive, strategies to address these vulnerabilities. Third, a system must be put in place for food defense monitoring, food defense corrective action, and food defense verification, which together ensure the system is working as intended to address the vulnerabilities. Fourth is recordkeeping.  Finally, there are training requirements. Personnel, and their supervisors, working at the most vulnerable points in a facility are required to take food defense awareness training and to have the education, training, or experience to properly implement mitigation strategies. In addition, preparing the food defense plan, conducting vulnerability assessments, identifying mitigation strategies, and engaging in reanalysis activities must be done or overseen by personnel with additional training or experience.   

Q: Are there certain foods that we are targeting with these food defense plans?

Newkirk:  No, on the contrary. One food is not inherently more at risk than another. It’s the processes that are the drivers of vulnerability. 

Q: Can you give me an example of a vulnerability?

Newkirk:  Yes. Examples include an open access hatch on a large liquid food storage silo or a very large mixing vat that is open without a lid. But keep in mind that these aren’t automatically vulnerabilities—it depends on the assessment carried out by the facility. 

Q: I understand that the main components of the rule stem from more than 15 years of working with industry. Does that mean the requirements are familiar to industry?

Woody: For the most part, yes. We began focusing on food defense back in 2001, working with other federal and state agencies that protect food. Assessing vulnerabilities and putting in place preventive measures to address them are familiar steps to the food industry. A presidential directive was issued in 2004 to require FDA and the U.S. Department of Agriculture to conduct food defense vulnerability assessments with industry. As a result, we’ve had some time to learn what works and what doesn’t, and industry has played a major role in developing that knowledge. In fact, the main requirements of the rule come from our collaborative efforts with industry.  
What’s new is that this is the first time that industry is required to take these steps—that part is novel. Up to now, food defense activities have been voluntary.

Q: If the major requirements are familiar, why have some members of the industry voiced concerns about this regulation?

Newkirk:  There is concern that the costs of complying with the rule are too high when considering the remote chance of an incident happening. We know that the likelihood of an incident happening at a particular facility is low, and thank goodness it’s low. But it’s not zero. And a single act could lead to wide-spread harm, causing illness, death and economic disruption of the food supply. If you look at the largest outbreaks of foodborne illness, you can see what could potentially happen.   

We are aware that industry has many questions regarding implementation of the rule in their facilities and the costs associated with implementation. That is why in March 2019 we released a revised and expanded installment of draft guidance that is intended to provide additional information to help industry comply with the rule. The most recent draft guidance adds to and replaces a version we published in June 2018. We believe that the information contained in the guidance will help address many of the concerns raised by industry.
The chapters of the current draft guidance are intended to help industry better understand:

  • the components of the food defense plan;
  • how to conduct vulnerability assessments by
    • using the four Key Activity Types method (bulk liquid receiving and loading, liquid storage and handling, secondary ingredient handling, mixing and similar activities),
    • evaluating the Three Fundamental Elements (potential public health impact, degree of physical access to the product, ability of an attacker to successfully contaminate the product), or
    • using the Hybrid Approach, which is a combination of the Key Activity Types and Three Fundamental Elements methods;
  • how to identify and implement mitigation strategies;
  • food defense monitoring requirements; and
  • education, training and experience requirements

This installment also includes the addition of food defense plan worksheets in Appendix 1 and a new appendix that includes detailed examples of vulnerability assessments using the Three Fundamental Elements and the Hybrid Approach. 

Q: How are you responding to these concerns about costs?

Woody:  We’ve built as much flexibility into the rule as possible to keep costs down. This is by no means a “one size fits all” regulation. For example, we don’t specify what method must be used to conduct the vulnerability assessment. Any method is acceptable as long as it has certain elements. In the first installment of the guidance, we identified four key activity types that FDA considers significant vulnerabilities. They are bulk liquid receiving and loading, liquid storage and handling, secondary ingredient handling, and mixing and similar activities. Instead of conducting a broader vulnerability assessment, a facility can identify actionable process steps for these specific activity types.  In the current installment of the guidance, we describe two more options (i.e., the Three Fundamental Elements and the Hybrid Approach) facilities may choose from to conduct their vulnerability assessments. 

And we do not specify what preventive steps must be used. Companies have significant flexibility in choosing which mitigation strategies are most appropriate for them. For example, in the first installment of the guidance, we describe numerous mitigation strategies.  There are instances where technology-based strategies may be the best way for a facility to reduce a significant vulnerability.  In other instances, a strategy that is based on personnel may be a more practical and cost-efficient strategy that still reduces the significant vulnerability.  Several years ago, we made available a free, Mitigation Strategies Database that contains examples of preventive measures. 

Additionally, there is significant flexibility built into the requirements related to food defense monitoring, food defense corrective actions, food defense verification, and training. 

Q: Did you visit any facilities to learn how food defense is being handled now?

Woody: Because of our long history of working on food defense, we’ve carried out many site visits —even before FSMA was enacted. We’ve seen many different types of facilities and products. Additionally, since the final rule published, we’ve continued with site visits, and our discussions with industry regarding their current food defense programs.

In March 2018, we joined FDA Commissioner Scott Gottlieb on a tour of the Nestlé Dreyer’s Grand Ice Cream facility in Laurel, Maryland. At the facility we were able to observe how the operation worked from the receiving dock to the production line to the packing equipment. Most importantly, as we went through, we saw firsthand the processes and practices that Nestlé has implemented to guard against intentional adulteration, and talked with Nestlé executives about the challenges they face in trying to safeguard the food from deliberate contamination.

This type of facility visit and feedback from stakeholders helps us to better understand the challenges and concerns they have. After hearing stakeholder concerns and touring the facility, Dr. Gottlieb wrote a blog highlighting the need to protect food from intentional adulteration in a way that is as practical and flexible as possible.

Since this visit, we have continued to meet with a number of stakeholders.  During these meetings, we believe we have made good progress in addressing important areas of concern and uncertainty.   For example, we reiterated the Commissioner’s statement that workers’ safety takes precedence over implementing food defense requirements.  We emphasized that FDA does not expect facilities to undergo incredibly costly reengineering of plants or move huge pieces of equipment to comply with the rule. 

Q: Are there any exemptions to the requirements?

Newkirk: The law requires us to focus on the greatest risks and the areas of most concern, so we have provided some exemptions to minimize the burden on industry. The rule is designed to primarily cover large companies whose products reach many people, exempting smaller companies. For example, the requirements do not apply to very small businesses averaging less than $10 million in sales per year. They do have to document that they are exempt, however. There are also other exemptions, including the holding of food, except for liquid food, and for farms.

While not technically exemptions, I would also add that there are other examples of acts of intentional adulteration which generally fall outside the scope of this rule. This includes acts by disgruntled employees, consumers, and competitors and economically motivated adulteration. These other acts typically are not meant to cause widespread harm.

Economically motivated adulteration is very different because the goal is financial gain. We decided that addressing economically motivated adulteration worked better under the preventive controls framework, which focuses on hazards that are known or reasonably foreseeable. The final rules on preventive controls for human and animal food address economically motivated adulteration if it can affect the safety of the food and is reasonably foreseeable. Economically motivated adulteration that affects product integrity or quality, but not food safety, is out of the scope of those rules. However, substitution for something cheaper could result in adulteration or misbranding under the Federal Food, Drug, and Cosmetic Act.

Q: When do facilities have to comply with the requirements?

Newkirk: Larger businesses—those that are not considered small or very small businesses under the rule—have until July 26, 2019 to comply with the requirements. Small businesses, which employ fewer than 500 people, have until July 27, 2020 to comply. Very small businesses are exempt from most of the requirements, but by July 26, 2021, they must document that they meet the requirement to be exempt. About 9,800 food facilities are covered by the intentional adulteration rule. The rule also applies to facilities outside the country who meet coverage criteria and export food to the United States.

Q: When will routine inspections begin, and what will they look like?

Newkirk: FDA has heard from stakeholders that due to the novel nature of this rule and its requirements more time is needed to develop fully compliant food defense plans. We are working hard to provide resources, including the final portion of the draft guidance, which may be helpful to industry. To allow industry time with the forthcoming materials, tools, and trainings, and because the IA rule represents new regulatory territory for all of us, the start of routine IA rule inspections will begin in March 2020.

While routine inspections won’t start until March 2020, we are not changing when firms must be in compliance. Keeping the compliance dates ensures industry will put in place measures that protect public health while FDA makes additional guidance and resources available.

When routine inspections begin in March 2020, our focus will be to “educate while we regulate.” In the context of the IA Rule, this means that our initial routine inspections will consist of food defense plan “quick checks” to verify that the facility has satisfied the basic requirements of the rule. For those facilities that have reached their compliance dates under the IA rule, these checks will be done at the same time as already-scheduled food safety inspections to verify compliance with other regulatory programs, such as Preventive Controls for Human Food, Juice HACCP, Seafood HACCP, and others. During the quick check FDA investigators will ask the owner or operator of the facility a series of questions such as “do you have a food defense plan?” and may provide some educational materials.  

Q: What are your plans for training?

Woody: We need training for both industry and inspectors who will be checking to make sure the requirements are met. There are currently a number of courses available through the Food Safety Preventive Controls Alliance (FSPCA) to meet the training requirement in the IA rule, such as  “Food Defense Awareness for the Intentional Adulteration Rule”, “Conducting Vulnerability Assessments using Key Activity Types”, and “Identification and Explanation of Mitigation Strategies.” The training requirement is flexible, and these courses are just one way to meet it. We’ve already initiated a series of webinars that can be viewed online.

Q: What resources are available to help industry better understand the rule? 

Newkirk: We have released the first two installments of the draft guidance, with the remaining chapters that cover areas such as corrective actions, verification, reanalysis, and recordkeeping in greater detail planned for a later release. The chapters in these first two installments include some of the more technical parts of the rule, as well as some of the requirements that drive compliance costs.  We believe these installments include valuable information for stakeholders who have questions about how to comply and concerns related to cost of compliance. 

We have also published a small entity compliance guide, and the preamble to the final rule is another valuable resource on how best to comply. We believe that the information contained in these guidance documents will help address many of the concerns raised by industry. 

In addition, we just recently released the new Food Defense Plan Builder (FDPB) version 2.0. This software program was updated so that the content aligns with the requirements of the IA rule. The FDPB may assist the food industry in meeting many of the requirements of the rule. The FDPB guides users through a series of sections that, when completed, make up the content for a facility’s food defense plan. Although the content of the FDPB is consistent with the FDA’s existing regulations and guidance, use of the FDPB is voluntary, and using the tool does not guarantee compliance with the rule’s requirements or FDA approval of a food defense plan. 

For More Information