Actionable Process Steps and Focused Mitigation Strategies http://www.fda.gov/fsma

Actionable Process Steps Defined as: “a point, step, or procedure in a food process at which food defense measures can be applied and are essential to prevent or eliminate a significant vulnerability or reduce such vulnerability to an acceptable level.”

History of FDA Vulnerability Assessments

Using Vulnerability Assessments to Identify Key Activity Types Distill individual processing steps down to the basic activity being conducted Standardize diverse processing steps for analysis Use information gathered in vulnerability assessments to target mitigation strategies to most vulnerable areas

Using Vulnerability Assessments to Identify Key Activity Types Results of this analysis show: Certain processing steps repeatedly ranked high across vulnerability assessments, regardless of food Focus on the activity being conducted at high ranking processing steps Common vulnerabilities can be organized into broad activity groups = key activity types

Proposed Requirements Covered facilities will be required to prepare and implement a written food defense plan, which would include the following: Actionable process steps– this step identifies actionable process steps by using one of the two options. If a facility chooses Option 1, the facility must assess whether it has one ore more of the following FDA-identified key activity types: Bulk liquid receiving and loading Liquid storage and handling Secondary ingredient handling Mixing and similar activities If a facility chooses Option 2, the facility must perform a vulnerability assessment using appropriate methods and qualified individuals to identify and prioritize points in the food operation that are vulnerable to intentional adulteration Focused mitigation strategies would be identified and implemented at each actionable process step in order to significantly minimize or prevent the significant vulnerability and ensure food is not adulterated Monitoring procedures would provide assurance that focused mitigation strategies are consistently performed and records to document the monitoring would be required Corrective actions would be used if focused mitigation strategies are not properly implemented Verification would ensure that monitoring is being conducted, appropriate decisions about corrective actions are being made, and focused mitigation strategies are consistently implemented and are effective Recordkeeping is also required The proposed rule requires food defense awareness and specific mitigation strategy training of employees and supervisors working at actionable process steps The proposed rule also requires certain records to be prepared and maintained

Key Activity Type I: Bulk Liquid Receiving and Loading Likelihood of uniform mixing (sloshing and turbulence) High volume of food is at risk Activity where an “outsider” could gain access (e.g. truck driver)

Key Activity Type II: Liquid Storage and Handling Likelihood of uniform mixing Tanks are frequently agitated High volume of food is at risk Especially in bulk storage or ingredient metered tanks Frequently located in isolated areas, increasing the likelihood an attacker could gain access without being observed

Key Activity Type III: Secondary Ingredient Handling Likelihood of uniform mixing ingredient handling is likely immediately prior to a mixing step High volume of food is at risk Ingredients are open and accessible

Key Activity Type IV: Mixing and Similar Activities Likelihood of uniform mixing High volume of food is at risk Food is typically accessible Extended mixing times may present opportunity for the attacker to “choose the best moment” to introduce a contaminant

Sample Processes not Considered Key Activity Types Conveyer belts, augers, flumes, etc. Bulk storage of dry ingredients Finished ingredient storage (containerized) Packaging Baking, frying, pasteurization, etc. Dry ingredient receiving/loading Frozen storage breader, mill, grinder, pulverizer, etc.

Perform a Facility-Specific Vulnerability Assessment Perform a vulnerability assessment using appropriate methods and qualified individual(s) Identify and prioritize points in food operation that are vulnerable to intentional adulteration Identify actionable process steps for significant vulnerabilities

Elements of a Facility-Specific Vulnerability Assessment Evaluate agents of concern Assemble vulnerability assessment team Develop process flow diagram

Elements of a Facility-Specific Vulnerability Assessment cont. Identify significant vulnerabilities, consider: Public health impact Downstream processing Physical access to product Ability of aggressor to contaminate product Volume of product impacted Identify actionable process steps

Actionable Process Steps Requirements: Identified using key activity types, or Identified by vulnerability assessment Identification and assessment must be written

Proposed Requirements 1. Actionable Process Steps 2. Focused Mitigation Strategies Identify and implement focused mitigation strategies at actionable process steps Option 1 Assess whether your facility has one or more of these FDA-identified key activity types*: Bulk liquid receiving and loading Liquid storage and handling Secondary ingredient handling Mixing and similar activities 3. Monitoring Establish and implement procedures for monitoring focused mitigation strategies Identify actionable process steps for each applicable key activity type 4. Corrective Actions Establish and implement procedures for corrective actions if focused mitigation strategies are not properly implemented Option 2 Perform a vulnerability assessment using appropriate methods and qualified individual(s) Covered facilities will be required to prepare and implement a written food defense plan, which would include the following: Actionable process steps– this step identifies actionable process steps by using one of the two options. If a facility chooses Option 1, the facility must assess whether it has one ore more of the following FDA-identified key activity types: Bulk liquid receiving and loading Liquid storage and handling Secondary ingredient handling Mixing and similar activities If a facility chooses Option 2, the facility must perform a vulnerability assessment using appropriate methods and qualified individuals to identify and prioritize points in the food operation that are vulnerable to intentional adulteration Focused mitigation strategies would be identified and implemented at each actionable process step in order to significantly minimize or prevent the significant vulnerability and ensure food is not adulterated Monitoring procedures would provide assurance that focused mitigation strategies are consistently performed and records to document the monitoring would be required Corrective actions would be used if focused mitigation strategies are not properly implemented Verification would ensure that monitoring is being conducted, appropriate decisions about corrective actions are being made, and focused mitigation strategies are consistently implemented and are effective Recordkeeping is also required The proposed rule requires food defense awareness and specific mitigation strategy training of employees and supervisors working at actionable process steps The proposed rule also requires certain records to be prepared and maintained 5. Verification Verify that monitoring is conducted Verify that appropriate decisions about corrective actions are made Verify that focused mitigation strategies are consistently implemented and are effective Conduct reanalysis of the food defense plan, as appropriate Identify and prioritize points in food operation that are vulnerable to intentional adulteration Identify actionable process steps for significant vulnerabilities *FDA identified these key activity types using findings of vulnerability assessments of over 50 food products and processes.  These activity types commonly rank high in vulnerability based on various factors, including the ability to physically access the food or process and the potential to adulterate a sufficient quantity of product in order to cause massive public health harm. 

Focused Mitigation Strategies Defined as: “those risk-based, reasonably appropriate measures that a person knowledgeable about food defense would employ to significantly minimize or prevent significant vulnerabilities identified at actionable process steps, and that are consistent with the current scientific understanding of food defense at the time of the analysis”

Focused Mitigation Strategies Applied in response to an identified significant vulnerability Customized to the actionable processing step Tailored to the facility Depend on an evaluation of vulnerabilities

Types of Mitigation Strategies FDA categorizes mitigation strategies into two buckets: Broad mitigation strategies: general facility-level measures not necessarily specific to the product or process, for example: Exterior fencing, periodic employee drug testing, visitor sign-in procedures, cyber-security, contractor or supplier audits

Types of Mitigation Strategies cont. Focused mitigation strategies: Specific and customized to the actionable processing step where they are applied. More effective at countering an attacker who has legitimate access to the facility

Mitigation Strategies Broad Facility or company level measures Broadly applied Almost universally applicable Not required, though still recommended Focused Specific measures applied at an actionable process step Tailored to address an identified significant vulnerability Required under Proposed §121

Focused Mitigation Strategies FDA giving facilities flexibility to determine appropriate focused mitigation strategies Preamble to Proposed §121 provides: Examples of focused mitigation strategies for reference and context for each key activity type A series of hypothetical scenarios to illustrate the decision-making process of identifying and determining appropriate focused mitigation strategies

Focused Mitigation Strategies Designed to minimize chances of intentional adulteration at the specific process step by: Minimizing the accessibility of an attacker to the product Reducing the opportunity for the attacker to successfully contaminate the product Or both

Focused Mitigation Strategies Examples Control access to the actionable processing step and related equipment Limit staff access, lock access hatches, physical barriers Ensure the area is free of unrelated materials Prohibit and monitor employees for personal items in work areas These examples can be found in Preamble to Proposed §121.

Focused Mitigation Strategies Examples cont. Maximize visibility around actionable process step Improve lighting or install cameras intended to prevent an attacker from adding a contaminant Peer-monitoring or “buddy system” procedures Prevents an attacker from operating in isolation These examples can be found in Preamble to Proposed §121.

Focused Mitigation Strategies Examples cont. Make engineering enhancements to equipment Install lids or other barriers to prevent introduction of a contaminant Reduce time products and ingredients are accessible Reduce the opportunity for an attacker to introduce a contaminant

Focused Mitigation Strategies Examples cont. Conduct inspections of equipment immediately prior to use Inspections increase chances of detecting a contaminant in tanks, hoses, and other equipment Use automated, self-contained, enclosed equipment Prevents introduction of a contaminant into the system

Focused Mitigation Strategies Facilities will need to evaluate their situation to understand why and how their actionable process steps are significantly vulnerable May be different in every facility

Focused Mitigation Strategies Facilities would then need to identify and implement the appropriate focused mitigation strategies to reduce the significant vulnerabilities Document this decision and provide justification for how the strategy significantly reduces or eliminates the risk of intentional adulteration at the actionable process step

Focused Mitigation Strategies Focused mitigation strategies must be: Documented in the food defense plan with justification Monitored for consistent application, with corrective actions as necessary Monitoring procedures must be documented Verified to confirm they are implemented as planned through a review of records and periodic re-analysis of the food defense plan

Focused Mitigation Strategies When identifying and implementing focused mitigation strategies, consider: Do you already have a procedure in place that protects this process step? Modify or improve an existing practice? FDA tools and guidance to assist in identifying suitable and appropriate focused mitigation strategies: http://www.fda.gov/food/fooddefense/