IMPORTERS and FILERS: FOOD SECURITY PREVENTIVE MEASURES GUIBANCE

Transcription

1 GUIDANCE OR INDUSTRY IMPORTERS and FILERS: FOOD SECURITY PREVENTIVE MEASURES GUIBANCE This guidance represents the Agency s current thinking on appropriatezili, measures that can be taken by food estabtishments to minimize the ris food being subjected ta tampering or crimina or terrorist actans. It do& nat create or confer any rights for or on any person and does not opera % to bind FDA or the pubic, This guidance is being issued in accordancec~ with FDA s Good Guidance Practices reguation (21 CFR VM15; 65 FR J ; September VI, 2000).. :_ I ;.., 1 This guidance is designed as an aid to operators of food importing (r i --; estabishments, storage warehouses, and fiers. It identifies the kinds of :;.: preventive measures that they can take to minimize the risk that food under their *-* contro wi be subject to tampering or crimina cx terrorist actions. Operators&f food jrnp~~ing estabishments are encouraged to review their current procedures and contros in fight of the potentia for tampering or crimina or terrorist actions and make appropriate improvements. This guidance is designed to focus the operator sequentiay on each part of the process that is within his/her contro, to minimize the risk of tampering or crimina or terrorist action at each segment. The impementation of enhanced preventive measures requires the commitment of management and empoyees to be successfu and, therefore, both shoud participate in their deveopment and review. This guidance is divided into three sections: Estabishment Operations and Practices, Security Strategies, and Evauation Program. It provides a ist of issues that refate to individua components of food impying operations and practices: Management of Food Security, Empoyees, Data Systems, Physica Security, and Products and Shipments. Not a of the guidance contained in this document is appropriate Or practica for every food importing estabishment. Operators shoud review the guidance in each section that reates to a component of their operation, and assess which preventive measures are suitabe for their operation. A process caed Operationa Risk management (ORM) may aso hep operators prioritize the preventive measures that are most ikey to have the greatest impact on reducing the risk of tampering or crimina or terrorist actions in their estabjshment or produds received. (See: Food Safety and Security: Operationa Risk Management Systems Approach, November 26, 200 I ; wwwxfsan.fda.gov).

2 1. Estabishment Qwrations and Practices: FOOD IMPQRTING OPERATIONS Management of Food Security Securitv procedures 4 assigning res~ons~b~~~ty for security to quaified individua(s) encouraging a staff to be aert to signs of tampering with product or equipment or systems, or other unusua situations, or areas that may be vunerabe to tampering and to notify identified management about any findings (e.g., provide training, institute a system of rewards, buid into job performance standards) I nvestiqation of suscticious activity * immediatey investigating a information about suspicious activity aerting oca aw enforcement about a suspected crimina activity iuoervision providing an appropriate eve of supervision to a empoyees, incuding data entry personne, computer support, ceaning and maintenance staff* and contract workers, and especiay new empoyees * conducting daiy security checks of the premises for signs of tampering with product or equipment, other unusua situations, or areas that may be vunerabe to tampering MaiVDackaqes + impementing procedures to ensure the security of incoming mai and packages (e.g., secure mairoom, visua OF x-ray mai package screening) Empoyees Pre-hirina sereeninq 0 obtaining and verifying work references, addresses, and phone numbers performing crimina background checks, incuding FBI Watchist [remember to consut any state and oca aws that may appy to the performance of such checks] checking immigration status with the ~mrn~grat~on and Naturaization Service, if appropriate appying these screening procedures to a empoyees, incuding seasona, temporary, contract and vounteer empoyees Da& work assinnments knowing who is and who shoufd be on premises, and appropriate ocation being specific to shift and authority keeping assignment information updated dent~~~ation estabishing a system of positive identification and recognition (e.g., photo identification badges, with individua contro numbers, coor coded by area of authorized access) * coecting the retired identification badge when an empoyee is terminated, either vountariy or invountariy Restricted access_ imiting access to those areas and portions of the operation necessary for the empoyee s pssition, incuding access to data operating systems for purchasing, storing and distributing impotied foods (e.g., key card or cypher ocks to sensitive areas, coor-coded uniforms) [remember to consut any reevant federa, state or oca fire OF occupationa safety codes before making any changes] * changing combinations and/or coecting the retired key card when an empoyee is terminated and additionay as needed to maintain security 0 reassessing eves of access for a empoyees periodicay 2

3 Persona items * restricting persona items aowed in estabishment preventing empoyees from bringing persona items (e.g., unch containers, purses) into food handing areas 0 estabish a poicy and providing for inspection of contents of empoyee ockers (meta mesh ockers, company-provided ocks), bags, and vehices when on company pw=fv Training in securitv Brocedureq 0 ensuring empoyee buy-in (e.g., demonstrate the importance of security procedures to the empoyees themseves) * providing food security training to a new empoyees, incuding information on how to prevent, detect, and respond to tampering or crimina or terrorist activity providing periodic reminders of the importance of security procedures Unusua behavior Watching for unusua behavior by new empoyees or workers (e.g., workers who stay unusuay ate after the end of their shift, arrive unusuay eary, access fj~es/informat~on/areas of the faciity outside of the areas of their responsibiity, remove documents from the faciity, ask questions on sensitive subjects, bring cameras to work) Data Systems a restricting access to computer operationa systems and other critica systems to those with apprupriate cearance (e.g., passwords, firewas) eiminating system access immediatey upon empoyse termination estabishing a system of traceabiity of computer transactions reviewing adequacy of procedures for backing up critica computer-based data systems 0 auditing the system routiney to assure security procedures are in pace * vaidating and periodicay chaenging the data security system and procedures Visitors a inspecting incoming and outgoing vehices for inappropriate or unusua items or activity restricting entry to the estabishment (checking in and out at security or reception, proof of identity, visitor badges - coect upon departure) 0 ensuring there is a vaid reason for the visit before providing access to the faciity - beware of unsoicited visitors * restricting access to food handing and storage areas (accompanied by empfoyee uness specificay authorized) 0 restricting access to ucker rooms 0 appying the above procedures to everyone, incuding contractors, suppier representatives, truck drivers, customers, couriers, third-party auditors, reguators, reporters, visitors, etc. Phvsica faciity protecting perimeter access with fencing or other appropriate deterrent securing doors ~in~ud~ng freight oading doors), windows, roof openings/hat~hes, vent openings, traier bodies, raicar& and storage areas (e.g., ocks, seas, sensors, aarms, guards, video surveii!ance) [remember to consut any reevant state and oca fire codes before making any changes] using meta or meta-cad doors5 to the extent possibe, especiay when the faciity is not in operation 3

4 minimizing the number of entrances to restricted areas [remember to consut any reevant state and oca fire codes before making any changes] * accounting for a keys to the estabishment using security patros (uniform and/or pa~n~~othed) and/or video surveiance, where appropriate 0 minimizing paces that may serve as temporary hiding paces for intentiona contaminants (e,g.$ minimize nooks and crannies) e providing adequate interior and exterior ighting, incuding emergency ighting impementing a system of controing vehices authorized to park on the premises (e.g., pacard, deca, key card, cypher ock) Storaqe of hazardous chemicas ceanina and sanitizina agents, pesticides) 0 securing storage areas for hazardous chemicas (e.g., ocks, seas, aarms, sensors) (remember to consut any reevant state and oca fire codes befure making any changes) imiting access to storage areas (use key cards or cypher ocks) (remember to consut any reevant state and ooaf fire codes befure making any changes) + inspecting chemicas upon receipt and verifying authenticity keeping track of hazardous chemicas investigate missing stock or other irreguarities outside norma variation and aerting oca aw enforcement of any unresoved probems Products and Shipments Supoiers using ony known, appropriatey icensed or permitted (where appicabe) sources for a products taking steps to ensure that suppiers and transporters practice appropriate food security measures (e.g., auditing for compiance with food security measures that are contained in purchase and shipping contracts or etters of credit) authenticating abeing and packaging configuration in advance of receipt of shipment (abeing shoud be traceabe to a specific foreign manufa~turing~~r~cess~ng faciity) inspecting incoming products for authenticity, packaging/~roduct integrity, and evidence of unauthorized reabeing/r~pa~kaging (e.g., shipping cases and described contents not consistent with actua contents) and verifying batr;hot/container codes and aerting appropriate authorities of any evidence of tampering, counterfeiting, or sabotage verifying cunformance with FDA requirements for product safety, quaity, effediveness, and abeing (may require contact with and verification from the foreign manufa~turer/proc~ssor) deveaping and impementing procedures for inspecting shipping containers, vehices deveoping and impementing procedures for assessing safety of abnorma powders, odors, iquids present on shipments investigating damage and oss and aerting appropriate authority of discrepancies requiring transportation companies to conduct background checks of drivers and other empoyees with access to product (state and oca aws may appy) requesting ocked and seaed veh~c~es~~onta~ners~raj~ars, obtaining the sea number from the suppier, and verifying upun receipt - make arrangements to maintain the chain of custody when a sea is broken for inspection by a governmentat agency reconciing the amount received with the amount ordered and the amount isted on the invoice and shipping documents reconciing the amount received with any reports of samping prior to receipt of shipment supervising off-oading of incoming products and product returns 4

5 Securitv of products keeping track of products, incuding savage, reworked and returned products estabishing receiving (examination), quarantine, and reease procedures investigating missing stock or other irreguarities and aerting oca aw enforcement of any unresoved probems ensuring that pubic storage warehousing and shipping (vehices and vesses) practice appropriate security measures (e.g., auditing for compiance with food security measures that are contained in contracts or etters of guarantee) performing random inspection of storage faciities, vehices, and vesses for evidence of appropriate and effective security program requiring transportation companies and warehouses to conduct background checks on staff (drivers/warehouse personne) (state and oca aws may appy) requesting ocked and seaed vehices/containers/t-aicars and providing the sea number to the consignee (remember to consut any reevant federa, state or oca fire or occupationa safety codes before making any changes) restricting access to distribution process to empoyees with appropriate cearance advising saes staff to be on the ookout for counterfeit products during visits to customers and notify management of any probems aerting oca aw enforcement about evidence of tampering or counterfeiting II. Securitv strateftp& Response to tampering or crimina or terrorist event having a step-by-step strategy fur triaging the event panning for emergency evacuation, incuding preventing security breaches during evacuation * having investigation procedures identi~ing critica decision-makers e identifying management to whom empoyees shoud report potentia security probems * identifying oca, state, and federa poi~e/~re/rescue/guvernment contacts identifying a media spokesperson * having a generic press statements and background information Reca strategy 0 jdenti~~ng the person responsibe, and a back-up 0 providing fur proper disposition of recaed product * ~dent~~ing customer contacts, addresses and phone numbers Additiona steps * maintaining any foor or fow pan in secure, off-site ocation * having interna, fire, and poice emergency phone numbers avaiabe to appropriate empoyees * making empoyees aware of the company officias to aert about potentia security probems, and where they can be reached becoming famiiar with the emergency response system and the Emergency Command Center operations in the state in which the faciity is ocated Data Systems * having contingency pans having a back-up database and eectronic inventory 0 restricting emergency access to empoyees with appropriate cearance

6 It. Evauation Praaram: Qperators of foad importing estabishments shoud consider: a evauating the essons earned from past tampering or terrorist events * annuay reviewing and testing the effectiveness of strategies (e.g., conducting mock crimina, terrorist or tampering event and mock reca, chaenging computer security system) and revising accordingy - using third party or in-house security expert * performing routine, random, and documented food security inspectiun of faciity (using third party or in-house security expert verifying that security contractors are doing an adequate job US. Food and DrucJ Administration 5600 Fishers Lane Rockvie, MD If a food import estabishment operator suspects that any of his/her products that are reguated by the FDA have been subject to tampering or crimina or terrorist action, he/she shoud notify the FDA 24-hour emergency number at 30% or ca their foca FDA District Qffice. FDA District Office teephone numbers are isted at htto~/~w~.fda*~ov/ora/insoe~t ref/~um/iomoradir.htm. The operatur shoud aso notify oca aw enforcement. 6