Incidents, emergency situations, withdrawals and recalls

Contents

• The standards.
• The requirements.
• BRCGS Food Safety Issue 9.
• Recall tests
  • Recall test: cryptosporidium scenario
  • Recall test: malicious contamination
• Emergency situation tests
  • Flooding
  • Cyber-crime

The standards

This article details the requirement for incidents, emergency situations, recalls and withdrawals. The following information complies with:

BRCGS Food Safety Issue 9	3.11 Management of incidents, product withdrawal and product recall 3.8.1 Management of non-conforming product
BRCGS Packaging Issue 6	3.13 Management of product withdrawals, incidents and product recalls 5.7.1 Management of non-conforming product
BRCGS Agents & Brokers Issue 3	3.11 Management of incidents, product withdrawal and product recall
Storage & Distribution Issue 4	3.7 Management of product withdrawal and product recall 3.8 Incident management and business continuity 5.2.7 Distribution incidents
FSSC22000 Version 5.1	ISO22,000: 8.4 Emergency preparedness and response, 8.9.5 Withdrawal/recall
IFS Food Version 7	5.9 Management of incidents, product withdrawal, product recall
SQF Edition 9	2.6.3 Product Withdrawal and Recall 2.6.4 Crisis Management Planning

The requirements

Incident management

Supply-chain communication

Where the business is handling product which is not owned by them, they must notify the owner where their product is implicated.

Where an incident implicates non-conforming traded product, the supplier must be notified.

Evidence of the formal notification must be retained, including details of who it was reported to and when.

Supplier requirements

Contracts must be in place with product handlers so that if an incident or emergency situation occurs while the product is under their control, the supplier must notify the business. Verification of this will also take place during supplier approval.

Transport related incidents

The incident procedure must detail what the driver must do where an incident occurs or is highlighted during loading, transportation or unloading of the vehicle, including:

• Who to report the incident to and how.
• Any controls to be implemented.
• Actions to be taken to manage any potential risk to the product.

Highlighting incidents

The procedure must include:

• What would constitute an emergency situation and a non-conforming product issue which should be escalated as an incident.
• How to report an incident.
• How to record the initial information.
• Who is authorised and competent to manage the initial aspects of the incident.
• Instructions to implement the non-conforming product procedure where product is affected.

All personnel must be trained to report incidents.

Incident team

There must be a multi-disciplinary team of key staff.  Each member must have a predefined role, responsibilities and contact details. Where group provide team members or leadership, the communication and reporting links between the site members and off site members needs to be predefined.

The team must include non-conforming product Decision Makers.

The team must be trained.

Procedure

The procedure must include:

• An incident management team, who manage emergency situations and product incidents which require withdrawal or recall.
• An up-to-date key contacts list.
• An internal and external communication plan which can be implemented in a timely manner and out-of-hours.
• Details of external agencies providing advice and support (e.g. laboratories, regulatory authority and legal expertise).
• Guidelines for deciding whether a product needs to be recalled or withdrawn.
• How to instigate and manage withdrawal and recall.
• Defined responses to known risks must be documented (e.g. identification of pathogens in routine product sampling).
• A plan to handle the logistics of product traceability, recovery or disposal of affected product, and stock reconciliation.
• A plan to record key activity, actions and timings of when events occurred, this must include recording of:
  • When the incident or test started.
  • Times of internal communications and key decisions.
  • When traceability and mass balance exercises were started and completed.
  • Communication to customers or regulatory authorities.

Scope

In the event of a product incident or emergency situation, the business must be ready to instigate actions as promptly and efficiently as possible.

The objective is to minimise risk to customers, consumers and potential disruption to business activity.

Emergency situations – product incidents

Where the emergency situation has affected product, or where product has been contaminated so that it’s unsafe or illegal, the procedure must detail:

• That if product has been released from the site, withdrawal or recall must be considered.
• That if product is within the business’ control must be held as non-conforming product pending investigation.
• The steps that must be taken to trace the materials.
• The contact details for the team who must be involved in the traceability exercise.
• References to where emergency contact details for suppliers and contractors are held.
• How to handle malicious contamination incidents, including which regulatory contacts must be informed.

Emergency situations – contingency plans

Contingency plans must be in place to ensure that emergency situations are managed effectively. The scope of the contingency plans must include consideration to the following as a minimum:

• Disruption to key services such as; water, energy, transport, refrigeration processes, staff availability, and communications.
• Disruption to services that your business supplies.
• Disruption to customer orders due to product withdrawal or recall.
• Events such as; fire, flood or natural disaster.
• Malicious contamination, sabotage or extortion.
• Failure of, or attacks against, digital cyber-security.

The aim of the contingency plans is to prevent disruption to the supply of customer products.

Is there a risk assessment in place, which assesses the risk to supply? Does the risk assessment consider key operations and infrastructure, including:

• Premises.
• Raw materials and packaging procurement.
• Labour.
• On line systems and services necessary to produce the product.

Does the risk assessment take into consideration the scale of the problem? Ideally it should classify the term of the outage, for example 24 hours, 48 hours, one week, more than a week etc.

There must be manual back-up systems in place, for when IT systems fail. Staff must be trained in how to use these systems.

Communication

The business’ certification body must be notified within 3 working days in the event of a significant incident, including:

• A product recall.
• Regulatory product safety non-conformity (e.g. a regulatory enforcement notice).

Review

Following an actual emergency, withdrawal or recall – a review must take place to assess the effectiveness of the recall.

Areas for improvement must be identified and corrective actions applied.

Root cause analysis must be applied where the withdrawal or recall was due to non-conforming product.

Supply-chain communication

No matter if a withdrawal or recall is initiated by the business, a customer or supplier, the business must be able to react quicky and effectively, to lead or assist in the process, including:

• Tracing and providing information about products that may have been in their control.
• Tracking and putting on hold any affected product within their control.
• Providing any business-specific technical support to aid in the investigation.

The business’ contact details, including those for out-of-hours must be communicated to customers and relevant suppliers. Contact details for customers and relevant suppliers must also be kept by the business, and kept up-to-date. These details must be kept up-to-date by periodically checked for this reason. Where they change, changes must be communicated to customers and relevant suppliers in a timely manner.

Review

Contingency plans must be reviewed and kept up to date if changes occur at site that could impact plans. (For example, a new supplier is introduced or new key equipment etc.)

Horizon scanning must be in place to consider new potential business continuity risks relevant to the business.

The outcome of raw material risk assessment must be considered as part of business continuity plans. For example, the risk of sourcing a key raw material solely from one supplier.

Testing procedure

Testing of the procedures must be carried out, the aim being to:

• Test the emergency situation procedure and associated contingency plans.
• Test the recall and withdrawal procedures.
• Test the incident management team.
• Test that the system can be implemented effectively during office hours and out of hours.
• Demonstrate that the system works, or highlight any gaps where the system requires improvement.
• Demonstrate how quickly the required information can be collated and corrective action taken.
• Act as a training exercise for the incident team.

Records of tests must be kept, including:

• A summary of the test.
• Who was involved in the test.
• How long it took to complete.
• Materials traced, and percentage recovered.
• Any supporting documentation.
• Notes of key activities and timings.
• Any gaps identified and associated actions.

Contingency plans, withdrawal and recall must be tested at least annually.

BRCGS Food Safety Issue 9

• Authenticity has been added to the scope of the incident management system.
• A contingency plan is now needed for product contamination incidents.
• The interpretation has been expanded to align the requirements with 3.11.2, as the system must include procedures for recall and withdrawal.
• The times that key activities happen must now be recorded when a recall or withdrawal occurs.
• The scope of testing has been expanded to include incidents, not just recall and withdrawal.
• The scope of significant incidents has been expanded to include authenticity and legality.
• The clause has been expanded to detail what must be provided to the certification body following a significant incident. The interpretation provides guidance on what must be provided to the certification body and timings for when this must be completed by.

Recall and contingency tests

The following test scenarios can be used to check that your incident management system works.

Each one will provide a situation where:
• Product may have been affected and therefore may need to be withdrawn or recalled.
• Traceability will be required to establish affected product (meaning you can use this as a combined recall and traceability test if you wish).
• An emergency situation (business continuity) is involved.

Try not to disregard the scenario if you feel that it does not apply to you. Get the team together anyway, to review the situation, to really challenge yourself (play devil’s advocate) and to prove that it would not put you at risk. You may find there are still lessons to be learnt.

Recall test: cryptosporidium scenario

Scenario

1.It’s Monday morning 9:10am and the local water authority has called the main site phone number. The site manager is on annual leave and the site management team are in the morning meeting.

If your site has a morning meeting at this time, then allow it to take place as normal.
If your site has a morning meeting at a different time, change the timing of the call in the scenario to match this.
If your site doesn’t have a morning meeting, change the type of meeting to suit.
The aim is to ensure that the management team are out of the way, to establish if the rest of the site team know how to raise the alarm.

2.The representative from the local water authority asks to speak to the most senior person on site, as there is an issue with the safety of the water that is being supplied to the site. As the site manager is on holiday and the rest of the management team are in the morning meeting, the person that answers the main phone number passes the call to the next deputy to the site management team.

You will need someone to act as the representative from the local water authority.
Get this person to call the main switchboard number. Explain that this is a test, that they are calling from the local water authority and that they must speak to the most senior person on site, as there is an emergency situation which affects the safety of the water that has been supplied to the site.
Get them to provide contact details for them to call back to get all the details.

Record

• Main phone number answered by?
• Does this person know who to transfer the call to?
• Does this person have written instructions to follow?
• Does this person understand the seriousness of the situation?
• Result of call: transferred to/ message taken.

3.The message gets through to the management team. The member of the management team calls back to get the details. The member of the management team must then follow the recall and emergency situations procedure.

The nominated person who is acting as the representative from the local water authority should provide the following information to the member of the management team that calls:
1.There has been an outbreak of Cryptosporidium in the local area.
2. The local water authority are advising the public to boil all drinking water and water used for washing food and food equipment.
3. The issue was first picked up late on Saturday night, therefore all water that has been supplied to the site since Saturday could have been contaminated. The exact timing has not yet been established, so the water authority are advising to air on the side of caution.

Record

• Record how long it takes for the site management team to be notified.
• Record how long it takes for them to call back.
• Record what the member of the management team does next.
• Do they know how to instigate the recall team?
• Do they relay the information to them correctly?
• Does the recall team follow the recall procedure?
• Is the procedure detailed enough to be able to know what to do?
• Does the recall team record the investigation, the actions they take, who they’ve called, what they’ve said, timings etc?
• Does each member of the team know their roles and what their responsibilities are?

Key outcomes:

1. Does the recall team establish what product may be affected through traceability?
2. Do they assess the risk of this product and take any necessary action to ensure that the customer is not put at risk?
3. Do they get in touch with relevant parties (informing them that this is a test) such as customers and distribution chains?
4. Do they ensure that any affected product is located and confirmed as contained?
5. Do they assess the safety of water that has been consumed by personnel during this time? And, have they taken necessary actions to contain secondary contamination from personnel who may be ill?
6. Does the team assess the impact on the product being produced? Do they either stop production, or, implement a system of positive release? Or, do they produce a documented risk assessment that details why production can safely continue?
7. Does the team instigate contingency plans for disruption to water? Are these plans sufficiently detailed to manage this event? This should include calling contracted suppliers as part of the contingency plan and ensuring that the expected timescales and agreements can be met.

Recall test: possible malicious contamination

This scenario provides a situation where:

• Product may have been affected and therefore, may need to be withdrawn or recalled.
• Traceability will be required to establish affected product (meaning you can use this as a combined recall and traceability test if you wish).
• An emergency situation (business continuity) is involved.

Instructions

To ensure that the following scenario really tests the incident team, the test should be managed by someone who is independent from the team. That way the information can be provided by them at the right times. This person should make notes on how the team handle the test scenario. The information below includes ‘team assessment’ points, to help them to do this.

Scenario

1.It’s Friday morning 9:30am and the weekly complaints have been received. 

One of the complaints is a metal foreign body in product _____________ from customer __________, use by/best before date_____________.

The description of the foreign body says that the product contained a number of small metal screws.  A photograph of the foreign bodies has been attached to the complaint.           

2. Friday 4:30pm: The technical manager gets a call from the customer. The customer explains that they have received a second complaint of a number of small metal screws in a product. It’s the same type as product as the first complaint. The product in question has been taken back to a store in Sheffield by the customer. No photos have been provided at this stage. The customer has asked for an investigation to be conducted immediately, to establish if this is a wider issue.

Team assessment

• Does the Technical Manager pull the recall team together?
• Is the information relayed to the recall team members correctly?
• Is a traceability carried out on both batches of product to establish where the product has gone?
• Does the team put any product within their control in the supply-chain on hold to contain it?
• Is an investigation carried out of the plant to establish if the small metal screws could have come from the process?
• Does the team organise to pick up the product from the store?
• Does the team agree what actions (and who is responsible for making sure they happen) should be taken when the foreign bodies and the product arrive back at site?
• Does the team analysis to have the product and the foreign bodies sent away for analysis?
• Is malicious contamination investigated?

3. Friday, 6pm: The Technical Manager gets another call from the customer, to say that a store operative has noticed something sticking out of one of the products in a store in Worksop. On opening the product, they found a small screw. The product is a different product to the previous 2 complaints, as it is _________.  As the store operative has opened the product, it’s not clear if the packaging had been tampered with at this stage. The customer requests that their product be withdrawn and production stopped until the source of the problem can be established.  

Team assessment

• Does the team look to pick up the product from Worksop, and speak to the store operative who found the issue, to establish what condition the packaging was in?
• Does the team look to compare the production records for all 3 products for similarities, including personnel who were involved in the production of the product?
• Where possible do they view CCTV of the 3 production runs?
• Does the team know how to withdraw the product and ensure that any product in the supply-chain is contained and confirmed as contained?
• Do they carry out a mass balance to ensure that all the product in the supply-chain has been contained?
• Does the team put in place specific plans to highlight immediately if any further complaints are received?
• Do they review any necessary additional interim actions that are required to ensure that any other product is not affected over the weekend?

4. Saturday 10am: The foreign bodies from the complaint are received by site.  They are found to be detected when they are passed through the metal detector.

Team assessment

• Does the team review the information (in person or virtually) and record their findings?
• Do they agree further actions?
• Do they inform the customer of the new information and record this?

5. Monday 9am: No further complaints have been received.

Team assessment

• Does the team establish a start-up plan with the customer?
• Does the team identify weaknesses in the production process for malicious on-site contamination?

Completion

Once the above scenario is completed, get the team together to go through the results. The person who managed the test can then share their team assessment notes.

Emergency test – flooding

This scenario may provide a situation where:

• Product may have been affected and therefore may need to be withdrawn or recalled.
• Traceability will be required to establish affected product (meaning you can use this as a combined recall and traceability test if you wish).
• An emergency situation (business continuity) is involved.

Instructions

A nominated person should call the production manager at 6am and provide them with the information detailed in the scenario.

Scenario

1.It’s rained heavily throughout the previous day and during the night. At 6am, the production manager receives a call to say that the drains on site are overwhelmed with water and so water is starting to back up. The local area is flooding and this has made some of the main roads impassable. The day shift starts at 6am and there are concerns that many of the team may not be able to make it to site. Deliveries went out on time overnight, but not all of them have made it to their delivery points in time. Some deliveries have been rejected and some are late coming back, which may affect product being dispatched during the forthcoming day.

Team assessment and test results

• Record what time the call is made and if they get through or have to leave a message.
• If a message is left, record how long it takes for the production manager to call back.
• Does the production manager then follow the necessary procedure and get the incident team together?
• How long does it take for the team to get together (in person or virtually)?
• Does the procedure provide enough detail as to what to do in this situation?
• Does the team now, and during the course of the incident keep related parties informed, such as customers?
• Do they record the events, the dates and times, who they have spoken to, the actions taken?
• It is clear that all members of the team know their responsibilities, what procedures they should follow and that the contact details they need are available to them are correct.

2.Development at 6:30am: 60% of the shift has arrived at site for their day shift, including drivers. The nominated person should inform the team of the development.    

Team assessment and test results

• Does the team establish what effect the reduced resource will have?
• Are there contingency plans in place for reduced resource situations?
• Do the plans include; which production lines, or products to prioritise, or other similar plans?

3.Development 7:20am: It has been raised by a team leader in the factory that a leak has developed in the roof over packing line _____. The leak is over open finished product and the operators on the line noticed this at 7:12am.  They are not sure when it started, but it is thought it was not there when the shift started at 6am. The nominated person should inform the team of the development. 

Team assessment and test results

• Does the team ensure that the line is stopped?
• Do they trace the product that has been produced and where it has gone?
• Are actions put in place to contain the affected product?
• Do they assess the risk to production and what controls are required to re-start the line, including cleaning?  Is a formal re-start process put in place with sign off?

4.Development 7:40am: The rain has stopped. The nominated person should inform the team of the development.

5.Development at 11:30am: 10% of the vehicles have not yet returned to site. The nominated person should inform the team of the development.

Team assessment and test results

• Does the team establish what impact 10% loss of available vehicles will have on the site?
• Does the team have a contingency plan for disruption to transport?
• Is the plan detailed enough to provide guidance for this situation?

6.Development at 2pm: Raw material deliveries have not arrived as planned. It is thought that the site will not receive deliveries until the roads are cleared.   The highways agency expects this to occur at about 10pm this evening. This also means that staff for the night shift will be affected and dispatch vehicles will also not be able to leave. The nominated person should inform the team of the development.

Team assessment and test results

• Does the team establish what impact the lack of deliveries will have on stock levels and if this will impact production?
• Does the team forecast the impact of reduced resource for the night shift?  Do the resource contingency plans cover this situation?
• Are actions put in place now to minimise the impact?
• For example, this may include getting a clear picture of how many staff may not be able to make it, by contacting them, or providing alternative travel arrangements for them.
• Does the team communicate new delivery schedules to their customers, aligned with when vehicles are expected to leave?

7.Development at 10pm: The roads have cleared, personnel and deliveries can get to the site and vehicles are able to leave. A clear up plan is required, to ensure that all effected product is dealt with and where required – customer approval is received, prior to re-starting.

Team assessment and test results

• Does the team develop a clear up plan which includes customer requirements?

Cyber crime

A real-life problem

You may think that cyber attacks only happen in the news and so, they’re something that won’t affect you. But you couldn’t be more wrong. They happen too often in the food industry.

Here’s what happened to one site, that will help to bring it to life for you.

When the staff at this site came into work one day and started up the computers to log in, they found all the folders were empty.

A message had been left for them in the folders, to say that they needed to pay a ransom to get the files back. This included all of the sites quality management system documents. It was all gone.

They had a back up system, so they contacted the IT team and asked them to restore the files. The files were backed up every 24 hours.

Unfortunately it had taken more than 24 hours to the team to realise that the files had gone and for the IT team to look for the back up. This meant that the back up had run a second time, and they only had one copy of the back up. Each time the back up ran, it over saved the back up before – meaning that the back up now only contained the message from the ransom message.

Luckily the site had some of the management system printed out, so they could re-type the procedures and records.  But they had other documents that were only held digitally – so these had to be recreated from scratch.

Take a moment

Just take a moment now, to just think about what that feel like – to realise that not only do you have all the things on your to do list today, but you also now have the task of rewriting the whole management system.

One hour today

Now you can imagine what that would feel like, put an hour in your diary this week – to look into your back up system. That hour could prevent a huge amount of pain in the future. If you can gather the team to do this for an hour, even better – as you’ll be able to divide up and tackle different systems. Below is a guide on how to get started.

Check your cyber crime contingency plan

The BRCGS standards state that our incident procedure now needs to include contingency plans for the failure of digital cyber-security. So, if you record the checks you’ve done, you can use this as evidence that you’ve tested your cyber-crime system as part of your contingency plan tests.

To do this, you need to:

Identify what systems are digital, starting with your management system and then going on to think about all the other digital records. For example:

• Purchasing systems.
• ERP (SAP, Dynamics 365).
• Average weight systems.
• Auto coding systems.

Then for each system, check that

• The data backed up?
• How often the back up run?
• How many copies of the back up are kept (so if one is corrupt do you have another to fall back on?).
• How would the back-up be deployed?
• While the systems is down, how will you carry on production, purchasing, dispatching etc?
• Do you have manual alternatives that you can use?

Make a list of all the problems that you find and then ensure that they’re fixed – quickly. Fixing the problems, is often the aspect that most difficult to do. Don’t let them get forgotten, discuss them every day at the morning meeting if need be – imagine how you’d feel if you got hacked before you got the chance to fix them!