1. FaegreBD Consulting
1050 K Street NW  Suite 400
Washington  D.C. 20001-4448
Phone +1 202 312 7440
Fax +1 202 312 7460
MEMORANDUM
TO:
International Foodservice Manufacturers Association
FROM:
FaegreBD Consulting
DATE:
February 14, 2014
RE:
Overview of FSMA Proposed Rule on Intentional Adulteration
On December 20, 2013, FDA released a new proposed rule as part of the implementation of the Food
Safety Modernization Act (FSMA). The rule is formally titled “Focused Mitigation Strategies to Protect
Food Against Intentional Adulteration,” and focuses on preventive measures against acts of terrorism
against the food supply, which could cause large-scale public harm.
The rule has a similar framework to the proposed rule for preventive controls rule and to HACCP in that
it requires a written “Food Defense Plan,” an assessment of the manufacturing process for
vulnerabilities, mitigation strategies, accountability measures and recordkeeping requirements.
Reasoning Behind the Rule and Context – Why is FDA Doing This?
This rule implements three sections of the Federal Food Drug and Cosmetic Act (FFDCA), as amended by
FSMA:
1. Section 418, which addresses intentional adulteration in the context of facilities that
manufacture, process, pack, or hold food and are required to register with FDA
2. Section 419, which addresses intentional adulteration in the context of fruits and vegetables
that are raw agricultural commodities; and
3. Section 420, which addresses intentional adulteration in the context of high risk foods and
exempts farms except for farms that produce milk.
The foundational impetus for this rule is based on intelligence gathered since the attacks on the United
States on September 11, 2001, which indicates that terrorist organizations have discussed
contamination of the food supply as a means to harm U.S. citizens and disrupt the global economy. FDA

2. admits in the text of this rule that terrorist attacks on the U.S. food supply have been exceedingly rare,
but that the threat is a “potentially exceedingly high consequence event.” The agency states that
“intentional adulteration of the food supply can result in catastrophic public health consequences,
widespread public fear, loss of public confidence in the safety of food and the ability of government to
ensure food safety, and significant adverse economic impacts, including disruption of trade.” It also says
“efforts to protect against intentional adulteration require a shift in perspective from that applied to
traditional food safety” and that it “tentatively concluded that intentional adulteration, which is not
addressed by traditional Hazard Analysis and Critical Controls Point (HACCP) or other food safety
systems, likely will require different kinds of controls.”
FDA did not address intentional adulteration in its proposed rules on preventive controls for human
food, preventive controls for animal food, or produce safety. The scope of this proposed rule covers
only acts intended to cause massive public health harm, including acts of terrorism. Acts of disgruntled
employees, consumers, or competitors intended to attack the reputation of a company are not included
in the scope of this rule. Importantly, the increasingly critical issue of economically-motivated
adulteration (EMA) – adulteration for the purposes of obtaining an economic gain – is not covered by
this rule. Instead, FDA indicates it is considering addressing the EMA as part of hazard analysis in a
preventive controls framework where EMA is “reasonably likely to occur.” We expect FDA will include
additional rules and revisions to the preventive controls for human food rules with respect to EMArelated hazards within the next six months to a year.
This proposed rule was rushed to publication due to a U.S. District Court ordering a strict timeline for
release of proposed and final rules as part of FSMA implementation by June 30, 2015. FDA would have
liked more time to develop this rule, but they had no flexibility. Thus, the widely-held belief is that FDA
will be flexible with those food facilities which would be regulated under the rule and expects to make
changes.
Covered Entities and Exemptions – Which Facilities Will Be Covered? Which Will be Exempt?
This rule would apply to both domestic and foreign facilities required to register with FDA under Section
415 of the FFDCA. With this rule, however, FDA is targeting four key activity types, the presence of
which FDA believes indicates a significant vulnerability and high risk of intentional adulteration. These
activity types are:
1. Bulk Liquid Receiving and Loading - a step in which a bulk liquid is received and unloaded from
an inbound conveyance or loaded into an outbound conveyance where a contaminant can be
intentionally introduced and, if it is, it is likely that the contaminant will be distributed
throughout the liquid due to sloshing, movement, or turbulence caused by the receiving and
unloading or loading activity
-2-

3. 2. Liquid Storage and Handling - a step in which a liquid is contained in bulk storage tanks or in
holding, surge, or metering tanks where a contaminant can be intentionally introduced and, if it
is, it is likely that the contaminant will be distributed into the food
3. Secondary Ingredient Handling - a staging, preparation, addition, or rework step where a
contaminant can be intentionally introduced into a relatively small amount of ingredient or
rework and, if it is, it is likely that the contaminant will be distributed into a larger volume of
food
4. Mixing and Similar Activities - a step, such as mixing, blending, homogenizing, or grinding where
a contaminant can be intentionally introduced and, if it is, it is likely that the contaminant will be
distributed into the food
Similar to the proposed rule for preventive controls, however, there are a number of categories of
exemptions:
•
•
•
•
•
•
•
•
•
Receiving and loading of other types of foods (e.g., non-bulk liquids, solid foods, gaseous foods)
Holding food, except the holding of food in liquid storage tanks
Packing, re-packing, labeling, or re-labeling food where the container that directly contacts the
food remains intact
Transportation carriers
Manufacturing, processing, packing, or holding of animal feed
Activities of a food facility that is subject to standards for produce safety (produce farms)
Alcoholic beverages at a facility that meets certain conditions
Activities that fall within the definition of a “farm” (as defined in 21 CFR § 1.227)
Qualified facilities, which are defined as:
o A very small business (i.e., a business that has less than $10,000,000 in total annual sales
of food, adjusted for inflation)1, or
o A facility that meets two requirements:
 (1) During the 3-year period preceding the applicable calendar year, the average
annual monetary value of the food manufactured, processed, packed or held at
such facility that is sold directly to qualified end-users (as defined in this part)
during such period exceeded the average annual monetary value of the food
sold by such facility to all other purchasers; and
 (2) the average annual monetary value of all food sold during the 3-year period
preceding the applicable calendar year was less than $500,000, adjusted for
inflation
1
Note that this definition of “very small business” has a significantly higher total annual sales number than the
various numbers proposed with respect to the preventive control for human foods. In other words, certain
facilities in may be required to implement preventive controls but not be subject to the intentional adulteration
rule. This reflects FDA’s judgment that such facilities are less likely to be targets of terrorism because any act of
terrorism with respect to such a facility would have less impact, both from a mortality and economic disruption
standpoint.
-3-

4. FDA is specifically asking for comments on these exemptions and whether they are warranted.
Requirements of Covered Entities – What Will They Be Required to Do?
Much like the preventive controls rules, covered entities will be required to prepare and implement a
written food defense plan, which includes actionable process steps, focused mitigation strategies and
procedures for monitoring, corrective actions and verification. There are additional requirements for
personnel training and recordkeeping as well.
The food defense plan is to be based on a vulnerability assessment (analogous to a hazard analysis), for
which owners of covered entities will have two options. Facilities can conduct their own vulnerability
assessment, for which there are specific requirements such as a “qualified individual” to carry out the
assessment; or they may use the vulnerability assessment provided by FDA, which identified the four
key activity types list in the section above. The latter would, as FDA states in the rule, “eliminate the
need for a full vulnerability assessment.”
The law requires that the process of identification of actionable process steps be done “for each type of
food manufactured, processed, packed, or held at the facility” because vulnerability to intentional
contamination may differ based on the type of food and associated process, practices, and conditions at
the facility. Therefore, FDA is requiring that the facility assess whether it has any of the key activity types
for each type of food that is manufactured, processed, packed, or held at that facility.
The requirements of the food defense plan under the proposed rule are as follows:
1. Identify Actionable Process Steps: The rule defines “actionable process steps” as “a point, step,
or procedure in a food process at which food defense measures can be applied and are essential
to prevent or eliminate a significant vulnerability or reduce such vulnerability to an acceptable
level” and is analogous to a “critical control point” in the HACCP framework as well as to a
“hazard reasonably likely to occur” under the preventive controls framework. The written
identification of actionable process steps must include the justification for whatever conclusion
the owner, operator, or agent in charge of a facility reaches. A written analysis would still be
required even if the conclusion of the analysis is that there are no actionable process steps. One
example from the rule, in reference to the key activity type “mixing and similar activities,” is
provided here:
A facility may identify a mixing tank as involving the key activity type,
Mixing and similar activities, in its operation because the mixing tank
has an unsecured lid and several sample ports which provide direct
access to the food product and because a contaminant can be
introduced into the tank through the lid or one of the sampling ports
-4-

5. and, if it is, the contaminant would be distributed into the food. The
owner would conclude that the mixing tank is an actionable process
step. We would expect that this conclusion would be reached for
virtually all steps that involve mixing, blending, homogenizing, or
grinding because these kinds of process steps generally: (1) Present an
opportunity for access to the product at or just prior to the equipment
(e.g., in-feed conveyor); and (2) would cause a contaminant, if
intentionally added, to be distributed into the food. We expect this
conclusion to be reached regardless of whether the facility may already
have mitigation strategies in place to impede access to the mixing tank
(e.g., a “buddy system” that ensures that at least two employees were
present at the mixing tank at all times or a lock on the mixing tank
access ports).
2. Focused Mitigation Strategies: Covered entities must identify and implement focused
mitigation strategies at each actionable process step to provide assurances that the significant
vulnerability at each step will be significantly minimized or prevented and the food
manufactured, processed, packed, or held by the facility will not be adulterated. Such strategies
are defined as “those risk-based, reasonably appropriate measures that a person knowledgeable
about food defense would employ to significantly minimize or prevent significant vulnerabilities
identified at actionable process steps, and that are consistent with the current scientific
understanding of food defense at the time of the analysis.” The term “focused mitigation
strategies” used in the food defense context is analogous to the term “preventive controls” in a
HACCP-type framework. Examples of mitigation strategies may include sealing or locking
outbound conveyances of bulk liquid, or requiring that inbound conveyances be sealed or locked
as a condition of receipt of the bulk liquid. The rule lists examples of focused mitigation
strategies for each of the four activity types. The following is one such example for the key
activity type, “bulk liquid receiving and loading”:
Controlling access to the receiving or loading area, conveyances, and
equipment, including hoses and pumping machinery, to prevent an
unauthorized person from gaining access to the food during receiving or
loading. Access controls may include: strategies to easily identify
authorized persons, such as color-coded uniforms or badges; restricting
conveyance drivers to areas away from the receiving or loading area
(e.g., restricting them to a lounge or break room); securing hoses with
locking caps or in cabinets; and ensuring that conveyance access
hatches, vents, and inspection ports are secured.
-5-

6. 3. Monitoring: Facilities must also establish and implement monitoring procedures, including the
frequency with which they are to be performed, for monitoring the focused mitigation
strategies.
4. Corrective Action Procedures: Facilities must establish and implement corrective action
procedures that must be taken if focused mitigation strategies are not properly implemented.
5. Verification: Facilities must verify that monitoring is being conducted and appropriate decisions
about corrective actions are being made; verify that the focused mitigation strategies are
consistently implemented and are effectively and significantly minimizing or preventing the
significant vulnerabilities; and conduct a reanalysis of the food defense plan at least once every
three years and more often when circumstances warrant.
6. Training: Facilities must ensure that personnel and supervisors assigned to actionable process
steps receive appropriate training in food defense awareness and their respective
responsibilities in implementing focused mitigation strategies.
7. Recordkeeping: Facilities must establish and maintain certain records, including the written
food defense plan; written identification of actionable process steps and the assessment leading
to that identification; written focused mitigation strategies; written procedures for monitoring,
corrective actions, and verification; and documentation related to training of personnel.
The agency states that the food defense plan can also be used as a resource for facilities to capture
additional food defense-related information such as process flow diagrams, an evaluation of broad
mitigation strategies, emergency contact information, crisis management plans, action plans for
implementation of broad mitigation strategies, results of supplier audits, and other documents, analysis,
reviews, or information the facility finds relevant to its food defense program.2 FDA has also developed
and publicly released a software tool that can be used to assist a facility to develop its food defense
plan. This free tool is available here.
Compliance and Effective Dates
The proposed effective date is 60 days after a final rule is published, with flexibilities for facilities of
certain sizes. Facilities other than small and very small businesses would have one year after the
effective date to comply. Small businesses (i.e., those employing fewer than 500 persons) would have
two years after the effective date to comply with proposed part 121. Very small businesses (i.e.,
businesses that have less than $10,000,000 in total annual sales of food, adjusted for inflation) would be
considered a qualified facility and would have 3 years after the effective date to comply. Realistically,
2
Note, because a food-defense plan would be subject to FDA review during an inspection, all additional, nonrequired information included with the food defense plan would also potentially be subject to FDA review during
inspection. Facilities may wish to consider having separate crisis management and food defense plans which
reference each other in order to avoid this concern.
-6-

7. we expect FDA to announce it will exercise enforcement discretion with respect to compliance with this
rule for at least six months or a year after the final rule is published.
Additional Insights
As indicated previously, FDA was ordered by a court to release this rule, even after FDA repeatedly
indicated it did not have significant experience and expertise in food defense issues and that it was not
ready to release a rule. Not surprisingly, then, FDA has requested comments and sought data on various
aspects of this rule. In substance, FDA has admitted that it does not know what it does not know with
respect to food defense, how companies have implemented such programs in the past, and what
strategies companies have found effective in the past. We expect the final rule may include significant
additional changes, including additional exemptions and adjustments to the four key activity types and
to the types of focused mitigation strategies. Finally, we note that although the proposed rule uses its
own specialized language, it is ultimately remarkably similar to both standard HACCP principles and the
preventive controls for human food rules.
-7-