Food Defense is really fairly simple. You do a threat vulnerability assessment, you put assets and/or procedures in place to mitigate the risks and then you challenge and monitor the system to see whether it is effective.
I'll go through some mitigation strategies. By no means a complete list, of course.
1. Perimeter Defense
- Fencing
- exterior doors should be sturdy and always locked when not in use
- Employee entrances should be secured by cipher locks, swipe cards or the like.
- All exterior bulk tanks, etc. should be securely locked (no cheap locks)
- CCTV in place to monitor things
2. Shipping and Receiving
- Robust policies/procedures in place
- Incoming and outgoing shipments should be inspected for signs of intentional tampering or contamination.
- Incoming raw material deliveries are scheduled. Trucks are not allowed to just "show up".
- In a perfect world, driver identification would be checked against a photo provided by the trucking company.
- Access to shipping/receiving areas are controlled and monitored. Delivery drivers are kept outside the building, or in holding pens inside the building.
3. Mail handling
- Mail is not handled in production, storage or shipping areas.
4. Interior Defense Measures
- As a result of threat assessment, vulnerable areas are identified, and access to these areas are restricted and monitored. (CCTV).
- Establish a key registry. All door keys need to be identified, who has them, how many there are, etc.
- Unexpected changes in inventory needs to be reported and investigated.
- Suspicious packages need to be immediately reported.
- Access to all raw materials, finished products and packaging are restricted to authorized personnel.
- Storage areas are monitored on a regular basis.
- Chemicals and hazardous materials are locked in access controlled areas when not in use.
- Maintain an up to date inventory of chemicals and any hazardous materials.
- Access to IT infrastructure is restricted.
5. Personnel Defense Measures
- Background checks for prospective employees.
- ID cards or swipe cards required
- Any company supplied locker or storage area should spot checked on a random basis.
- Uniforms or other identifying clothing should be worn
- Be aware of any disgruntled employees. They are the most likely to commit intentional adulteration.
6. Non-Employee Defense Measures
- Non-Employees are required to follow all company policies. Short training session is preferred prior to entry into production, storage or shipping areas.
- Non-Employees are escorted while in the facility and not allowed access to restricted areas, unless their reason for visiting require access.
- Non-Employees are identified with badges, distinctive clothing, hair coverings, etc.
- Logs of Non-Employee arrival and departure are maintained.
7. Training
- Food Defense awareness training is provided to all employees.
- Specific training is provided to employees based upon their duties and responsibilities.
- Training should address access control measures and access to restricted areas.
- All employees are trained to report any suspicious activity.
- Employees that answer phones will be trained to respond to threats directed towards the facility, people, products or the brand of the company.
8. Investigation
- Any unusual activity/situation will be investigated by authorized and trained employees.
- All customer complaints will be investigated and resolved within seven days of complaint receipt.
9. Challenging the System
- Contract with third party and conduct an assessment where the third party actively tries to enter your facility and access restricted areas.
- Conduct in depth internal audits of the program.
- Place "suspicious packages" in restricted areas. Find out if employees report them.
10. Monitoring the system.
- Internal audits of the policies/procedures that make up the system.
- GMP audits should include checking the mitigation strategies that are in place.
I'm sure there are plenty more, and of course your plan will be totally dependent upon the size and location of your facility, what products you produce, who your employees are, what level of risk you determine you have and how much money is willing to be spent.
Marshall