In today’s global food industry, each key player in the supply chain (materials suppliers, manufacturers, and retailers) must have an effective business contingency plan (BCP, also called a business continuity plan). The Global Food Safety Initiative (GFSI) and other major second- and third-party auditors evaluate the efficacy of business contingency plans during site audits. This article focuses on BCPs for manufacturing plants. The BCP plays a critical role in helping a business to manage its reputation and continue its ability to serve customers in the event of a natural disaster (e.g. tornado, flood, fire, pandemic), accident, major food security-related problem (e.g. terrorist attack, intentional contamination), critical equipment failure, or major supplier disruption. The foundations of the BCP include human and food safety, product quality, communications, timely response, and customer service.
An effective BCP provides a competitive advantage, especially given the speed with which information is disseminated through print and electronic sources. It is possible for more damage to occur from a company’s mishandling of early phases of a crisis than from the crisis event itself. As such, a company should have effective, practical plans in place for managing crises and maintaining business continuity [2].
Companies with effective crisis management or BCPs are better able to achieve the following [2]:
- Minimise long-term impacts to the company
- Maintain a positive reputation
- Protect the brand
- Contain the crisis to the affected entity or brand, to minimise impacts on the overall industry
- Ensure actions are in accordance with established laws or regulations, and minimise legal liability
- Work quickly and efficiently with crisis responders and government organisations
- Rapidly identify and address the concerns of affected stakeholders
- Provide assistance to investigating agencies without endangering the organisation’s legitimacy
- Establish working associations with media, and choose authorities that will help to broadcast the organisation’s message
- Provide effective, precise, and timely information
- Control financial exposure
The objective of the BCP is to help the business to efficiently return to normal activities after a major incident that directly affects operations. The approach described in this article provides an example to assist management and BCP team members to return the business to its pre-incident position in the marketplace. Managers should receive BCP training upon hiring, as well as annual refreshers and updates when changes are made to the plan. Typically, senior site managers are responsible for nominating team members. Controls are implemented to ensure an effective response to crisis and to ensure that product safety and quality are not compromised [2].
The BCP team, contact information, and responsibilities should be described in detail in the BCP. An escalation plan and contact information for key internal and external stakeholders should also be part of the BCP. A few scenarios that relate to BCPs are discussed below. Please note that these scenarios are provided as examples only. Each business will have its own challenges based on its industry niche, location, workforce, complexity of operations, number of employees, hours of operation, business model, supply chain capabilities, infrastructure, and resources.
Terrorist attack or intentional food contamination:
Food supplies are vulnerable to terrorist attacks or intentional contamination by disgruntled employees or unauthorised persons, through the use of physical, chemical or biological methods [1]. A mock food recall (traceability exercise) is a good way to demonstrate efficiency of identifying and segregating affected product(s). Traceability exercises are time-based with the goal of 100% containment of affected product. This exercise is conducted by the recall team, which will trace material that is within and outside of the facility’s control. Any identified opportunities for improvement must be addressed quickly [1].
The company can initiate other proactive tasks as follows:
- Have well-documented and effective recall plans, tools, and training
- Perform mock food recall drills
- Provide training on food security (or a food defense plan) for all employees
- Perform annual mock food security drills
- Perform food security assessment of the facility and the distribution network
- Perform employee background checks and access control
- Identify alternate manufacturing sites and a plan of action in case of major business disruptions
- Generate a product disposition plan based on the specific situation and risk assessment
Tornado/Flood/Fire:
Natural disasters such as tornados, floods, and fire can cause major business disruptions and food safety issues. Each business must take actions to reduce the business impact due to natural disasters. Such actions include:
- Establish an Emergency Action Plan (EAP) and team
- Perform EAP team training and other employee, visitor, and contractor training
- Work with local government agencies to ensure the EAP is complete, effective, and meets regulations or code
- Perform risk assessment. Local weather station, fire department, and insurance companies can help with this assessment
- Identify alternate manufacturing sites and a plan of action in case of major business disruptions
Pandemics:
An outbreak of infectious diseases such as the Zika virus and Severe Acute Respiratory Syndrome (SARS) can have adverse health effects on employees and their availability to resume normal manufacturing operations. Each business must consider pandemic planning as part of the BCP. Such planning should include:
- Establish an EAP and team
- Have the EAP team assess the situation and agree to an appropriate action plan based on demand, available supplies, and available labor
- Implement appropriate prevention methods and procedures to reduce risk
- Have management staff review and take appropriate action regarding sick-leave absences unique to a pandemic, including policies that define when a previously ill person is no longer infectious and can return to work
- Work closely with the local health department to monitor the situation and to deploy appropriate control measures
- Identify backups for each job position and alternate manufacturing sites in pandemic response planning
IT disaster recovery:
An IT disaster recovery plan (ITDRP) should be prepared and considered as part of the BCP, where relevant [3]. The benefits to be accrued from preparing an ITDRP include [3]:
- Identification of critical processes and systems and their associated contingency and recovery procedures
- Establishment of disaster significance based on impacts to critical processes and systems
- Definition of people, skills, resources, and suppliers needed to assist in the recovery process
- Confirmation of vital records needed for restoring operations
- Definition of off-site storage arrangements
- Established mechanisms for testing and maintaining the plan
- Continuation of critical business processes and systems during the disruption
- Effective data backup and utilisation
- Definition of contingency methods for performing critical activities (electronic or manually) and associated procedures
- Challenging the effectiveness of the plan by performing the mock drills
An effective plan for communication with internal and external stakeholders during and after major disruptions or crises is critical to the success of the organisation. The company spokesperson plays an important role in the communication process; the BCP must identify the spokesperson and provide a detailed communication plan [2].
The primary reason for a food industry business to engage in continuity planning is to ensure that the company can function effectively and maintain food safety in the event of a severe disruption. Although businesses cannot prevent all disruptions, appropriate planning should enable essential operations to be maintained and the business to return to normal operations more rapidly than it would if it had no plan in place. The BCP focuses on the actions a business or site must take to maintain critical operations and to restore normal (or near normal) operations in the event that a significant disruption occurs [2]. Food safety risk assessment, mitigation, and communication play a critical role in the BCP.
By: Ravi Kumar Chermala, FIFST, CSci, RFoodSP
Disclaimer: The approach described in this article is an example only, based on the author’s experience. Each company has different requirements and expectations. Businesses should consult a qualified professional to assist in designing and developing an effective crisis response or business continuity plan.
References:
- U.S. Food and Drug Administration (FDA). (2014). Industry Guidance-Information on Recalls of FDA Regulated Products. Retrieved from http://www.fda.gov/Safety/Recalls/IndustryGuidance/default.htm
- Hiles, A. (Ed.). (2007). The definitive handbook of business continuity management (2nd ed.). West Sussex, England: Wiley & Sons.
- Shropshire, J. & Kadlec, C. (2009). Developing the IT disaster recovery planning construct. Journal of Information Technology Management (JITM), XX(4): 37–56. Retrieved from http://jitm.ubalt.edu/XX-4/article3.pdf