Tommy Thompson, outgoing U.S. Secretary of Health and Human Services, alarmed much of the American public when he expressed his concerns about a possible bioterrorist attack on the nation's food supply. "For the life of me," Thompson said in his resignation speech on December 3, "I cannot understand why the terrorists have not attacked our food supply because it is so easy to do."

Three days after Thompson made his comments, the U.S. Food and Drug Administration (FDA) issued the fourth and final in a series of regulations that implement a 2002 bioterrorism law enacted to protect the American population from bioterrorism attacks. Affecting approximately 700,000 companies in the United States, the new safety rules will require businesses to retain detailed source and shipping records for food products. These regulations impact manufacturers, packers, processors, shippers, and transporters. There are, however, some exemptions including restaurants and farmers.



"Food and Drug Administration officials say the required record-keeping system will be phased in over the next two years and allow them to rapidly trace food and recall it in the event of widespread contamination, including a bioterror attack."
The Wall Street Journal, 12/7/04

The U.S. food supply can be contaminated in a variety of ways. According to reports, threats range from deadly toxins and germ-infected livestock to infected food imports from overseas. It is also possible for terrorists to contaminate food at major restaurant chains. Though some experts say that terrorist organizations do not yet have the expertise to cause mass casualties with a bioterrorist attack, the U.S. government, consumer advocacy groups, and food industry organizations agree that bioterrorism threats could put the American public at serious risk.

The new FDA regulations require that sources and recipients of food record shipments at each step of the supply chain. In the event of a terrorist threat, an attack on the country's food supply, or in cases of contamination, the records must be made available to the proper authorities. Records for human food must be kept for six months to two years, and food for animal consumption must be kept for one year. In addition, food facilities must register with the FDA, and companies exporting food to the U.S. must provide advance notice of shipments, under previously issued regulations.



"These records will be crucial for FDA to deal effectively with food-related emergencies, such as deliberate contamination of food by terrorists... The ability to trace back will enable us to get to the source of contamination.”
Dr. Lester Crawford, acting FDA Commissioner, Associated Press, 12/6/04

Food industry companies with 500 or more employees are required to comply with the new FDA regulations by December 9, 2005 and companies with 11 to 500 employees must comply by May 9, 2006. According to The Wall Street Journal, the regulation will affect some 700,000 companies at an initial cost of approximately $1.4 billion. After implementation, the regulations are expected to cost the U.S. food industry as much as $123 million annually.

Businesses concerned with the FDA's new regulations should ask themselves the following questions:

• Do the new regulations apply to my company?
• Have I evaluated the contamination or bioterrorism risks related to my supply chain? Has my company taken steps to prevent or mitigate the impact of such events?
• What systems do I currently have in place to track food inputs and outputs? Have these systems been tested? Is there a record of it?
• Am I already compliant with the new regulations? What other steps do I need to take?
• How will complying with the new regulations affect my company resources? What training do my employees need?
• What are my company’s internal policies regarding non-compliance?
• Do I know the compliance level of my suppliers and business partners? How does this affect my company's level of compliance?
• How does the new regulation affect my product traceability and recall strategies? Do I have such strategies in place in the case of a contamination or bioterrorism event?
• Does my company have the necessary expertise in-house, or are outside resources required to ensure compliance?
• Have I evaluated my insurance coverage for contamination or bioterrorism events? What steps can my company take to ensure maximum coverage?
• Am I exposed to possible litigation from such an event, and am I prepared to manage it?

Faced with the FDA's new food supply regulations, companies need to understand how best to comply. They should consider conducting a supply chain risk assessment to identify key vulnerabilities and determine the potential financial impact of a food contamination threat on their businesses. As part of this process, current traceability systems should be reviewed in conjunction with crisis management and product liability strategies, and steps should be taken to make such processes compliant with the new regulation. In the event of a contamination, it is critical for companies to effectively implement their business continuity, product recall, and crisis management strategies to minimize damages and protect public health.

"There are any number of threats, and they range from what's done across the oceans to what's done in the kitchen in the restaurant that you're eating in.”
Michael Osterholm, associate director of the National Center for Food Protection and Defense at the University of Minnesota, a project of the Homeland Security Department, Chicago Sun Times, 12/6/04

Companies should also evaluate their insurance coverages and exposure to possible litigation related to a contamination or bioterror incident. "Insurance archaeology" may be necessary to uncover all relevant policies and terms, and systems may need to be established to manage any litigation.

Marsh's experts in supply chain risk management, business continuity, crisis consulting, product recall, product liability, and litigation support can assist food companies to identify, prioritize, and manage the risks associated with the new regulation. Working together, Marsh has the resources and experience to help companies anticipate their risk issues and manage compliance efforts.

If you have any questions or would like additional information, please contact us.