Business Continuity Plan... test?
However,
SQF 2.1.6.3 - The business continuity plan shall be reviewed, tested and verified at least annually.
Does anybody have any experience on how to "test" ones Business Continuity Plan? Perhaps with a "Mock Crisis"?
Not sure how to actually do an actual "Mock" crisis out of the following:
Type of Emergency
Loss of cooling after processing / Power Outage
Product temperature to be maintained at or below 40°F, temperature is not to exceed 45°F for more than an hour. If product reaches temperature of more than 45°F, disposition of product would be determined case by case. A food safety risk analysis shall be performed prior to making this determination. A corrective action will be completed concerning the hazard.
Chemical exposure
Product shall be discarded if there is any evidence or suspicion that products may have been exposed to any chemical contamination such as oil, grease, sanitation chemicals, etc. A food safety risk analysis shall be performed prior to making this determination. A corrective action will be completed concerning the hazard.
Fire and /or smoke damage
Product shall be discarded if there is any evidence or suspicion that product may have been exposed to fire and/or smoke.
Any affected water systems shall be drained, cleaned, sanitized, and recharged with fresh water. A food safety risk analysis shall be performed prior to making this determination. A corrective action will be completed concerning the hazard.
Blood, fecal, or bodily fluid exposure.
Product shall be discarded if there is any evidence that product may have been exposed to any blood, fecal material, or bodily fluids.
A food safety risk analysis shall be performed prior to making this determination. A corrective action will be completed concerning the hazard.
Flood water
Products shall be discarded if there is any evidence or suspicion that they may have been exposed to flood waters.
A food safety risk analysis shall be performed prior to making this determination. A corrective action will be completed concerning the hazard.
Any thoughts?
Cheers,
-C
For your examples, perhaps you could have a situation where you do it over a longer time period? Maybe alert the team at 9am that there is local flooding and more rain is forecast then at 11am have the water close to the door, at noon it's coming under the front door... you see how you can build it up? It's important in the scenarios you've raised to see what the early actions would be because if they've done nothing by the time the water is under the door I would say they've failed the challenge.
Another easy one could be to even act out a major accident with blood spillage (warn people and you could be the pretend casualty or rope in an operator.) Specify the range of the blood spillage and see what happens (I bet they forget the H&S side and concentrate on the food safety!)
I have to admit I really liked doing this kind of thing and I had some very positive feedback about it. What's most important once you have all of the results is to talk through with the people involved what happened, what went well, what didn't, what would they change, was the documentation they had a help or a hindrance etc.
good luck
Other scenerios to consider include (just a few off the top of my head):
What would you do if half your work-force coulden't show up to work tomorrow because of bird-flu or some natural disaster?
What if your major raw material supplier went into adminstration tomorrow?
What if the truck that transports your product to market rolled on the free-way and killed other motorists?
What if a disgruntled employee started sabotaging your product that then gets released to the market?
You need to consider not just the food safety aspects but also the damge to brand and your business.
Customers who require SQF as a basis of doing trade what to know that their own supply chain is safe and able to provide at all times.
Just a few things to consider so I hope it helps.
Cheers
Amanda
This being the company's 1st go at it, I thought, to break them in, do a crisis they have already gone through: Power Outage.
I'm having the meeting about it today (they will know the detailed that will be filled in), but here is what I wrote up to start with (we are in the RTE produce processing industry):
_______________________________________________
This will be an email to orchestrate the communication emails and “summaries” of phone calls in these emails to act as “evidence” of our Mock Crisis.
A) Power Outage threat: loss of temperature control.
B) Possible solutions:
1) Power Generation:
a. for temp. sensitive rooms
i. Storage
ii. Processing
2) Product Relocation:
a. Storage
b. Processing
c. Transporting
i. Temp monitoring
Identify Stake Holders and send email to explain: Mock Power Outage
1) Who is first to notify issue to “kick-off” incident”
a. Identify Scope (the area of power outage)
2) Who is part of Senior Management Involvement
a. Corporate vs. Plant
3) Who is communicated to for:
a. Product transport:
i. Who to contact for Capacity
ii. Who to contact for Time
iii. Who to contact for Transport logistics
1. Physical shipping times
2. Temp monitoring
iv. Who to contact for Destination logistics
1. Physical receiving times
2. Temp monitoring
b. Possibility of alternative location processing.
i. Who to contact to identify what products?
1. Who in Production
2. Who in Sales
a. For what customers (not affected by power outage).
The SQF Guidance doc suggest this mock crisis: "An annual review should have similar aspects to a mock recall." implying something other than a mock recall.
However, Issue 7:
1.9 SQF Guidance Documents
(page 23)
"The guidance documents are available to assist the supplier, but are not auditable documents. Where there is a divergence between the guidance document and the SQF Code, the SQF Code prevails."
Hence, ignore the Guidance Doc and a mock recall will suffice as a mock crisis/incident (and hit 2 birds with one stone).
We do 2 mock recalls annually.
I am a BRC guy (not required by BRC issue 5 as I remember) so this "mock crisis" other than a recall threw me off a bit.
Food for thought...
The SQF Guidance doc suggest this mock crisis: "An annual review should have similar aspects to a mock recall." implying something other than a mock recall.
I suspect many people wud interpret this as simply yet another mock recall. My guess is that SQF realised that by originally asking for a "crisis" they had created a disaster but were reluctant to backtrack.
"A rose by any other name ......"
Rgds / Charles.C
I certainly agree with HACCP Mentor and others (and our BCP reflects this), however, per the SQF Code:
2.1.6.1
A business continuity plan based on the understanding of known food safety threats to a business shall be prepared by senior management outlining the methods and responsibility the organization will implement to cope with a business crisis that may impact on the ability of the supplier to deliver safe food.
and
2.1.6.2
The business continuity plan shall include as a minimum:
i. A senior manager responsible for decision making, oversight and initiating actions arising from a crisis management incident;
ii. The nomination and training of a crisis management team;
iii. The controls implemented to ensure a response does not compromise product safety;
iv. The measures to isolate and identify product affected by a response to a crisis;
v. The measures taken to verify the acceptability of food prior to release;
vi. The preparation and maintenance of a current crisis alert contact list;
vii. Sources of legal and expert advice; and
viii. The responsibility for internal communications and communicating with authorities, external organizations and media.
All this does not preclude a "Mock Recall" as it is indeed a threat that "may impact on the ability of the supplier to deliver safe food".
I do not mean to be bureaucratic about this,our BCP does mention all of the other examples of Typical Emergencies (Loss of cooling after processing / Power Outage,Chemical exposure, Fire and /or smoke damage, Flood water, etc) and "execute procedures related to recall and other crisis situations".
We happen to use a Mock Recall to address:
2.1.6.3
The business continuity plan shall be reviewed, tested and verified at least annually.
Note:
To have a fall back, we do have a recent real documented actual power outage and how our BCP applied with provided evidence:
1) a timeline of events correlated with:
a. records QA records (SSOP’s,Temp Logs, Wash Logs),
b. emails and
c. city government event info
P.S. -
And again I would like to mention on page 23 of SQF Code (issue 7):
"1.9 SQF Guidance Documents: The guidance documents are available to assist the supplier, but are not auditable documents. Where there is a
divergence between the guidance document and the SQF Code, the SQF Code prevails."
Recall procedure: a definite must-have that has to be practiced to make sure all the traceability and contact info etc is in place and working...
"A mock recall and mock crisis exercise are two very different things. A recall relates to testing the traceability and removal of affected product from the market-place where a mock crisis is about testing business contingency procedures."
The two are essentially independent of each other. I suppose you could link them (e.g. you had a crisis, say for example a flood, and some potentially affected product wasn't identified and put on hold and subsequently found to have been shipped to customer(s). You could then do your Mock Recall exercise to show how that product was traced and recalled. I definitely don't see any advantage in linking the two exercises, however. You could just open a can of worms for the auditor (for example this might be valid for a "1 forward" trace but not for a "1 back" in the auditor's opinion).
IMO a Mock Crisis Exercise (a.k.a. Business Contingency Plan) should be kept as simple as possible for your SQF audit. If your policy, procedures and responsibilities have been written to comply with the code, my experience is to come up with a crisis like a flood, power outage, storm damage, fire, etc. and simply gather the Crisis Team together and go through the exercise chronologically, documenting events (communication to you legal counsil, media, employees, regulatory authorities, customers, etc.) as they happen, planning and decision making re. getting your company up and running, and most importantly describing (documenting) how potentially affected product (raw materials, WIP, finished product, and packaging) would be evaluated by qualified personnel in order to determine the disposition of these materials.
A quick question on the topic of BCP...we are having our first ever audit to become SQF certified (within the next month). Is the testing of the BCP expected to be done prior to the desk audit, or prior to the facility audit?
Yep...it sure is (I know the date is way past....but this may be beneficial for others to know in the same situation)
We just got a minor NC for that...
Would you possibly be able to share your template with please??
I have done two recall / BCP tests and I did them both on food safety issues. What I did was start the process with a pretend phone call and then give slips of paper with updates on to the team. I didn't take part because I figure that it's just blooming luck that when you have a real crisis, the Technical Manager is on holiday. I made the crisis have an obvious end point which you could lead towards but also tested their knowledge of legislation.
For your examples, perhaps you could have a situation where you do it over a longer time period? Maybe alert the team at 9am that there is local flooding and more rain is forecast then at 11am have the water close to the door, at noon it's coming under the front door... you see how you can build it up? It's important in the scenarios you've raised to see what the early actions would be because if they've done nothing by the time the water is under the door I would say they've failed the challenge.
Another easy one could be to even act out a major accident with blood spillage (warn people and you could be the pretend casualty or rope in an operator.) Specify the range of the blood spillage and see what happens (I bet they forget the H&S side and concentrate on the food safety!)
I have to admit I really liked doing this kind of thing and I had some very positive feedback about it. What's most important once you have all of the results is to talk through with the people involved what happened, what went well, what didn't, what would they change, was the documentation they had a help or a hindrance etc.