Table of Contents
I. Executive Summary……………………………………………………………………….….2
III. Risk Identification……………………………………….….........................................3
IV. Risk Assessment………………………………………………..……………………….…….4
V. Risk Mitigation ……………………………………………………………………………….5
a. Food Safety Modernization Act…………………….……………………………...6
i. Sanitary Transport…………………………………………………….…...6
ii. Food Safety Plan ……………………………………….…………....…….7
iii. Product Recall…………………………………………………….…………8
VI. Risk Monitoring………………………………………….………………………………..…9
RISK MANAGEMENT PLAN - [DATE] 2
It is the the company. to operate Vending Machine Food and Related Products
Distribution Centers that perpetually earn the reputation as being the best in the
industry at providing available inventory, on-time delivery, competitive pricing and
superior customer service.
We value our customers. They are the life force of our business. We bring the values
of our family and home to work in order to better serve our customers. We observe
the golden rule of proprietorship, and treat each Customer, supplier and employee
in the way we prefer to be treated. And because our customers are loyal, they
deserve our highest standards.
In alliance with our mission statement and values, it is our top priority that our customers are not only satisfied
but safe. For this reason, we have set forth the following procedures to ensure the safety of our customers,
employees, and reputation. We realize accidents happen however, in planning for these events we hope to
minimize their impact.
“You can always amend a big plan, but you can never expand a little one. I don’t believe in little plans. I believe
in plans big enough to meet a situation which we can’t possibly foresee now”. — Harry S. Truman
Risk Management is the process of identifying, assessing, responding to, monitoring, and reporting risks. This
plan documents the processes, tools and procedures that will be used to manage and control those events that
could have a negative impact on the company. It is the controlling document for managing and controlling all
inventory risks. It outlines how risk management activities will be performed, recorded, and monitored
throughout daily operations and provides steps and practices for recording and prioritizing risks. This plan will
• Risk Identification
• Risk Assessment
• Risk Mitigation
• Risk Monitoring
RISK MANAGEMENT PLAN - [DATE] 3
The objective of risk identification is the early and continuous identification of events that, if they occur, will
have negative impacts on the ability to achieve performance. In order to assess risk, it must first be identified in
order to determine, what threats make inventory susceptible to contamination. Identifying these risks are crucial
because they allow us to minimize the chances of inventory loss. The ultimate goal of food inspections is to
ensure the safety of all food products reaching consumers. To achieve this goal, a series of inspections are
suggested in order to protect the quality of inventory. The guidelines set forth in the provided checklist
(Appendix A) coordinate with inventory control regulations set forth in the Food and Drug Administration
Title 21 Regulations. Using this checklist should assist in the everyday compliance of FDA regulations and
minimize the chance of loss due to contamination.
Risk assessment is the act of determining the probability that a risk will occur and the impact that event would
have, should it occur. This is basically a “cause and effect” analysis. The “cause” is the event that might occur,
while the “effect” is the potential impact it would have to the company, should the event occur. Taking these
metrics into account, we will use what is referred to as a risk matrix scale in which to measure hazards and their
harms. This can be numeric (scale of 1-5), verbal (good to bad) or both.
(Table 1. Risk Assessment Severity Scale)
Probability of Occurrence
Definition Meaning Value
Will be continuously
experienced unless action
is taken to change events
• Occur less frequently if
process is corrected
• Issues identified with
minimal audit activity
• Occurs sporadically
• Potential issues discovered
• Unlikely to occur
• Minimal issue
• Highly unlikely to occur
RISK MANAGEMENT PLAN - [DATE] 4
The second factor is the estimate of the impact on daily operations. This can be a somewhat subjective
assessment, but should be quantified whenever possible. The estimated cost, the duration of the potential delay,
the changes in scope and the reduction in quality are in most cases factors that can be estimated and documented
in the risk statement and then measured using the standard project management tools. Rather than detailed
impact estimates the Risk Register contains five ratings for impact:
Five Ratings of Impact Severity:
Withdrawal of product manufacturer
A security finding requiring immediate corrective action prior to continued operation
Reoccurring violation of any safety regulation resulting in serious injury
Production errors containing regulatory violations that pose direct consequence to the quality of
Security finding requiring a corrective action plan
Production element errors that may pose indirect consequences to the operation
Minor errors in company policy & procedures
Production errors containing quality system and / or opportunities for improvement
Security/confidentiality element affected
Improperly executed communications
Statistically, the level of risk can be calculated as the product of the probability that harm occurs multiplied by
the severity of that harm. In accordance with the Risk Matrix (Appendix B) The company will be able to
quantify different levels of risk, helping to better prioritize loss exposure. It is suggested that any risk with a
quantitative risk over “5” be immediately documented and addressed by the crisis management team to be
RISK MANAGEMENT PLAN - [DATE] 5
The communication of pertinent information in a timely matter is essential to effective crisis management. For
this reason, knowing one’s role within the crisis management procedure is crucial to save time and ultimately
minimize loss. By establishing a clear concise job description or list of responsibilities, employees should aware
of their responsibilities. The division between staff, management, and upper management should have varying
roles within the response plan. Table 2 provides a generic outline of the difference in duties and responsibilities
each could accomplish.
(Table 2 Position Responsibilities)
• Establish a crisis management team
• Implement a crisis management plan
• Communicate information down the vertical
structure to next level management of
policies and expectations
• Handle communication between regulatory
agencies and public statements
• Ensure, that workers and other persons are
not put at risk from work carried out by the
• Ensure the workplace, including entry and
exit and anything arising from the fixtures,
fittings or plant are without risks to health
and safety of the plant.
• Establish and implement risk management
systems for all functions and activities of the
• Communicate to upper management any
risk greater than a “5” on the risk matrix.
• Compliance with Risk Management Policy.
• Contribute to the establishment and
implementation of the risk management
system. Staff members should know their
role within the risk management procedure
and who to report any inventory quality
RISK MANAGEMENT PLAN - [DATE] 6
FDA Food Safety Modernization Act
The Food Safety Modernization Act (FSMA) was signed into law on January 4, 2011. The legislation affects
every aspect of the U.S. food system, from farmers to manufacturers and wholesalers. The FSMA has given the
Food and Drug Administration (FDA) new authorities to regulate the way foods are grown, harvested, processed
and sold. The law grants FDA a number of new powers, including mandatory recall authority. It aims to ensure
the U.S. food supply is safe by shifting the focus of federal regulators from responding to contamination to
How does this affect Distributors and Wholesalers?
Transportation operations that must be conducted in order to prevent food from becoming unsafe during
• Ensuring adequate temperature controls
• Preventing contamination of food by contact with raw food or nonfood items
• Protection from cross-contact, i.e., food allergens
• Protection of food transported in bulk
If a shipper, loader, receiver or carrier becomes aware of an indication of a possible material failure of
temperature control or other conditions that may render the food unsafe during transportation, the food shall
not be sold or otherwise distributed. The shipper or loader is responsible for sanitary conditions (e.g., inspecting
truck) unless reassigned in written agreement.
• Condition and cleanliness/sanitation of the vehicle/rail car
• Specifying sanitation and temperature requirements
• Inspection prior to loading
• Temperature control- equipment and monitoring
• Sanitation- procedures, documentation, sharing information
• Hand washing facilities if food is not fully packaged
RISK MANAGEMENT PLAN - [DATE] 7
A Food Safety Plan
The FDA has established the proper steps to assess risk associated food inventory through the Food Safety Plan
(FSP). The FSP consists of the primary elements in a preventive controls food safety system that provides a
systematic approach to the identification of food safety hazards that must be controlled to prevent or minimize
the likelihood of foodborne illness or injury. It contains a collection of elements that describe activities to ensure
the safety of food during manufacturing, processing, packing, and holding. The FSP consist of the following
• A written food safety plan (FSP)
A “preventive controls qualified individual” (PCQI) (Appendix C) must develop (or oversee the
development of) the FSP. A PCQI is a person with the education, training, or experience to develop and
apply a food safety system. A PCQI can be qualified through job experience or by completing training
equivalent to the standardized curriculum recognized as adequate by FDA.
• Hazard analysis
Hazard analysis is to identify whether there are hazards requiring a preventive control. This hazard
analysis must be written, regardless of whether any hazards requiring a preventive control are
• Preventive controls
When the hazard analysis identifies hazards requiring a preventive control, preventive action must be
taken. For wholesalers this means maintaining proper temperature control for inventory and ensuring it
is being monitored.
You must establish and implement written procedures, including the frequency they are to be
performed, for monitoring preventive to fully describe your monitoring program, the procedures
should answer four questions: (1) What will be monitored? (2) How will monitoring be done? (3) How
often will monitoring be done? and (4) Who will do the monitoring?
• Corrective actions
You must establish and implement corrective action procedures that would apply if preventive controls
are not properly implemented, as appropriate to the nature of the hazard and the nature of the
preventive control. These include corrective action procedures that must be taken if you detect the
presence of a pathogen or appropriate indicator organism in a ready-to-eat product as a result of product
testing or if you detect the presence of an environmental pathogen or appropriate indicator organism
through your environmental monitoring activities.
When calibration or an accuracy check of a preventive control monitoring instrument shows that the
instrument is not accurate, you should evaluate the monitoring records since the last instrument
calibration to determine whether the inaccuracy would have contributed to a deviation. For this reason,
food safety plans with infrequent calibration or accuracy checks can place more products at risk than
those with more frequent checks if a problem with instrument accuracy occurs.
RISK MANAGEMENT PLAN - [DATE] 8
The company should ensure that it can demonstrate it has taken all reasonable and appropriate steps to protect
consumers and has fulfilled its legal obligations. In the event that a food safety issue occurs rapid identification
and removal of unsafe food from the distribution chain should immediately take place while informing clients
and government agencies of the presence in the market of a potentially hazardous food. While the Consumer
Product Safety Commission encourages immediate notification, it is the legal responsibility of any company to
report any hazard within 24 hours of obtaining reportable information. In the event a company does not
voluntarily recall a product, the FDA now has authority to force a mandatory recall under FSMA
Determining the Need for a Recall
Food that has become contaminated, or mislabeled, is subject to recall. When food is adulterated, it may be
impure, unsafe, or unwholesome; contain a pathogen (for example, Salmonella), a foreign material (for example,
plastic), or an undeclared allergen; or there may have been a packaging failure.
How are unsafe products discovered?
• Manufacturer or distributor tests or observations
• Test results from product sampling by the regulatory agency
• Field inspections, or investigations, by regulatory agencies
• Epidemiologic data (data on the occurrence of disease in a population) collected by local or state public
health departments or federal agencies.
If a regulatory agency finds that food has microbiological or chemical adulteration, or has statutory violations,
such as mislabeling, it presents the evidence to the manufacturer and asks the manufacturer to recall the product.
Once a food recall is announced by the manufacturer, responding to a Food Recall typically through a press
release, the manufacturer is required to notify all of its affected consignees. FSIS and FDA alert consumers about
food recalls through press releases, notices posted on their respective websites, and notices posted on
www.foodsafety.gov/recalls. For assistance in determining the correct path of action, consult the product recall
flowchart (Appendix E).
Product Recall Classifications
•Dangerous or defective
products that predictably
could cause serious health
problems or death.
• Examples include: food
found to contain
botulinum toxin, food
with undeclared allergens,
a label mix-up on a
lifesaving drug, or a
defective artificial heart
•Products that might cause
a temporary health
problem, or pose only a
slight threat of a serious
•Example: a drug that is
under-strength but that is
not used to treat life-
•Products that are unlikely
to cause any adverse
health reaction, but that
violate FDA labeling or
•Examples include: a
minor container defect
and lack of English
labeling in a retail food.
RISK MANAGEMENT PLAN - [DATE] 9
Continuous monitoring by the project risk manager and the crisis management team ensures that new and
changing risks are detected and managed and that risk response actions are implemented and effective.
Risk monitoring and control keeps track of the identified risks, residual risks, and new risks. It also
monitors the execution of planned strategies for the identified risks and evaluates their effectiveness.
Risk meetings should be held regularly to update the status of risks in the risk register, and add new risks.
This is not necessary for minor level risk, and may only be needed for the certain level risk the risk
management chair or upper management determines. Risk monitoring is a valuable step that can help
determine how effective the implemented crisis procedure is and what can be improved upon. Regular
meeting and monitoring will help loss prevention by determining the changing aspects of risk and how to
• Upper mangement has assenbeled a crisis mangement team with a risk mangement chair to head and
respond in the event of inventory containimation.
•A crisis proceedure has been implemented and food safety plan established by upper mangement.
•Risk are identified by mangement and staff in accordance with FDA regulations using the checklist provided
(see appendix A).
•Assess what aspects of daily operation are considering at risk using the risk matrix provided (see appendix
B). Anything over a "5" should be reported to management.
•Manufacturers and client contacts are organized and up to date and posted for quick reference
•Everyone knows their roles within the criris management proceedure.
•Immediately suspend the sale of item in question and quarantine until contamination can be determined
•Gather information and details of the contamination using the report form in order to convey details to
clients, manufacture, and regulatory agency (see appendix D).
•Use the product recall flowchart to help determine if a recall to clients is necessary or which stage the
contaminated inventory has reached in the supply chain.
•Properly dispose of contaminated inventory and implement corrective action.
•Have upper management issue statement to the affected party to ensure good will and future relations.
•Assess how contamination happened and monitor for future incidents.
•Continue to identify and assess risk.
RISK MANAGEMENT PLAN - [DATE] 10
Title 21 Code of Federal Regulations, Sec 110.36
Yes Needs Improvement
1. Are products stored on a first-in, first-out basis to reduce
the possibility of contamination through spoilage?
2. Are old products kept in front of the new to help with
inventory cycles of first in first out?
3.Are all incoming products dated to ensure a proper rotation
of stocks and for internal tracking purposes?
4. Are items overstocked? This increases the chances of
spoilage and contamination.
5. Are incoming vehicles inspected?
6. Are dusty, faded or discolored containers checked
7. Are all products spoiled by damage, insects, rodents or
other causes stored in a designated “Quarantine Area” to
prevent their contact with safe products?
8. Are such quarantined items disposed of quickly to prevent
the development of pest breeding places?
9. Are incoming materials inspected for damage or
contamination so that they can be rejected?
10. Are unused materials properly resealed to prevent
11. Are materials stored in a safe manner?
Food related items should not be stored with non-food related
items. Materials should be stacked so that vents and blowers
are not blocked. Stacks of materials should be orderly for
12. Do you have an effective recall procedure set up?
RISK MANAGEMENT PLAN - [DATE] 11
Who needs PCQI Training?
The Food Safety Modernization Act (FSMA) was signed into law in 2011. The goal is to make the food supply in
the USA is safe by shifting the focus of federal regulators from responding to contamination to prevention.
By September 16, 2016 the majority of companies need to have a Food Safety Plan that has been prepared by a
"Preventive Controls Qualified Individual (PCQI)". This means that companies need to have a PCQI in place
quickly so they can prepare and implement the Food Safety Plan before the September 2016 compliance date.
While the list of FSMA’s new requirements is dense and varies greatly for some types of facility, one key change
that applies to nearly all food companies is the introduction of a preventive controls qualified individual (PCQI).
Not only does FSMA require facilities to have a food safety plan implemented by the deadline date, but the plan
must be prepared and applied by a properly trained PCQI.
1. How does a person become a PCQI?
2. I am HACCP trained, is that enough?
First, the general route to becoming qualified as a PCQI is to take the standardized training course taught by a
"Preventive Controls Lead Instructor". This is an instructor that has applied to the Food Safety Preventive
Controls Alliance (FSPCA) been accepted and completed the Lead Instructor training course. They are able to
register the class with Association of Food and Drug Officials and students will receive an AFDO certificate if
they successfully complete the class. This approach clearly meets the requirements defined in 117.180 (c)(1) of the
preventive controls rule.
What about other options?
Because the rule is new, it has not been demonstrated what experience the FDA would consider as at least
equivalent to that provided through the standardized curriculum. However, there are some clues given in the
responses to public comments. The responses state:
" There are some differences in the requirements of the human preventive controls rule compared to the
requirements of Hazard Analysis and Critical Control Points regulations for seafood, juice and meat and poultry
such that training provided by the International HACCP Alliance may not be equivalent. Such an individual
may need to obtain supplemental training specific to the rule. Alternatively, a person who has received the
international HACCP Alliance training and has implemented a HACCP plan may be qualified through job
If you are experienced with HACCP, the standard course will cover information that you already know about
food safety. However, it will also help you become knowledgeable about the rule, be able to evaluate your
current system and be talking the same language when the inspectors arrive. It will also give you assurance that
you can demonstrate your qualification as a PCQI, and turn that “may be qualified” into a Qualified.
RISK MANAGEMENT PLAN - [DATE] 13
Information Reporting Form
Position in Business
Date & Time
Brand of Suspected Contamination
Name of Suspected Food
Reason for Suspicion
RISK MANAGEMENT PLAN - [DATE] 14
Product Recall Flowchart
The table below illustrates a flowchart of logical questions one could ask to assist in their decision during a
potential contamination. The colors indicate which stage of the risk management procedure the company is
Source: Australian Food and Grocery Council
RISK MANAGEMENT PLAN - [DATE] 15
Food and Drug Administration Greenville
300 Executive Center Dr., Greenville, SC 29615
Phone: (864) 234-9966
Food and Drug Administration Charleston
4600 Goer Dr. North Charleston, SC 29406
Phone: (843) 746-2990
RISK MANAGEMENT PLAN - [DATE] 16