The questionnaire arrives on a Tuesday from your importer in New Jersey. Question 14 asks you to list your actionable process steps and the mitigation strategies in your food defence plan under 21 CFR Part 121. Your TACCP study passed its last FSSC 22000 audit without a finding, and it contains neither term.
In short
- The FDA Intentional Adulteration rule (the IA rule under FSMA, 21 CFR Part 121) requires covered facilities to keep a written food defence plan built on a vulnerability assessment of process steps.
- In principle it reaches any facility, local or foreign, that must register with FDA. Exemptions and size categories apply, so confirm your own status with your US importer or FDA.
- Each step is evaluated on three elements: public health impact, physical access to the product, and the attacker’s ability to contaminate it successfully.
- Every mitigation strategy needs monitoring, corrective actions and verification. Reanalysis is due at least every three years.
- A PAS 96 TACCP study can serve both, once you add the process step layer.
Module 5 of the Food Defence Coordinator Course (R1 750, 10 hours, online) teaches the FDA method.
What is the FDA Intentional Adulteration rule under 21 CFR Part 121?
The IA rule is the regulation under the US Food Safety Modernization Act (FSMA) titled Mitigation Strategies to Protect Food Against Intentional Adulteration, at 21 CFR Part 121. Covered facilities must prepare and implement a written food defence plan against acts intended to cause wide scale public health harm.
The final rule was published in May 2016 and every compliance date has passed. Its scope is narrow. Adulteration for economic gain is dealt with under the FSMA preventive controls rules instead. Its content is prescriptive: a vulnerability assessment, mitigation strategies, and written procedures for monitoring, corrective actions and verification. Without those headings, the importer’s reviewer finds nothing.
Does the Intentional Adulteration rule apply to a South African exporter?
In principle the rule applies to any facility, domestic or foreign, that must register with FDA because it manufactures, processes, packs or holds food for consumption in the United States. Exemptions and business size categories change what is required, so confirm your own status with your US importer or FDA before you answer.
The exemptions cover, in outline, very small businesses (defined by a US dollar threshold averaged over three years, and the business must keep documents proving it qualifies), holding food other than in liquid storage tanks, packing or labelling where the container touching the food stays intact, farm activities under the produce safety standards, certain alcoholic beverage facilities, animal food, and some on farm egg and game meat activities of small businesses.
Before you type an answer, check your FDA facility registration, read the exemption wording in the rule itself, and ask your US importer, your US agent or FDA to confirm if you are borderline. This post is training material, not legal advice. Even where an exemption applies, the importer may still want an IA style plan as a condition of supply.
How is the FDA vulnerability assessment different from TACCP under PAS 96?
TACCP under PAS 96 starts with the attacker: who might want to harm you, where they could get in, and how likely and how severe the result would be. The FDA method starts with the process. Every step for every food type is evaluated against three fundamental elements, and the significant ones become actionable process steps.
TACCP asks who would do it. The FDA method asks at which step it would work.
The three fundamental elements
- Potential public health impact: severity and scale, which usually follow batch size.
- Degree of physical access to the product: open kettle or sealed pipe, locked hatch or wing nut.
- Ability of an attacker to successfully contaminate the product: whether enough agent could be added unnoticed and would then be mixed through the batch.
The assessment must consider an inside attacker, which removes most of the comfort a perimeter gives you.
The four Key Activity Types
From its own assessments, FDA identified four activities that repeatedly came out most vulnerable, and accepts their use as one appropriate method alongside evaluating the three elements step by step.
- Bulk liquid receiving and loading: the tanker bay, an open hatch and a hose.
- Liquid storage and handling: tanks and totes that are opened and drawn from over days.
- Secondary ingredient handling: the pre weigh room, where spices and premixes are opened and staged.
- Mixing and similar activities: kettles, blenders, grinders. Anything that spreads an addition evenly for the attacker.
| Point of comparison | TACCP (PAS 96) | FDA IA rule (21 CFR Part 121) |
|---|---|---|
| Threats in scope | Broad: several kinds of deliberate act, including malicious contamination, extortion and cyber crime. | Narrow: acts intended to cause wide scale public health harm. |
| Assessment method | Likelihood and impact scored for each threat scenario. Scales are yours to define. | Three elements per step, or the Key Activity Types. Output: actionable process steps. |
| Managing the controls | Implementation and review expected. Format left to the site. | Monitoring, corrective actions and verification, written down for each mitigation strategy. |
| Review | Kept up to date. Schemes commonly expect a review at least once a year. | Reanalysis of the whole plan at least every three years, sooner on defined triggers. |
For the scheme side, see our post on what each scheme requires for TACCP, VACCP and HACCP.
A TACCP study with no process step layer is the gap an importer’s reviewer will find. The TACCP and FSMA food defence training covers both. Modules 1 to 4 build and score the threat assessment on PAS 96:2026, a person marks your scoring, and module 5 covers the FDA method.
Start the TACCP and FSMA coordinator course, R1 750
What are actionable process steps and mitigation strategies?
An actionable process step is a point in your process where the vulnerability assessment finds a significant vulnerability. A mitigation strategy is a risk based, reasonably appropriate measure applied at that step to significantly minimise or prevent it. Each one is managed through monitoring, corrective actions and verification, as appropriate to the strategy and written into the plan.
Fencing and CCTV are worth having, but they do little against a permanent employee with a valid access card standing at an open kettle. The measure sits at the step.
Worked example
Mzansi Fresh Meals is ASC’s training case, a fictional Gauteng chilled ready meal plant. Take its 800 litre sauce kettle, which falls under mixing and similar activities.
The three elements. One batch becomes several thousand meals. The lid is open during additions. The agitator does the attacker’s mixing. It is an actionable process step.
Mitigation strategy. Only named cook room staff, in a distinct cap colour, may enter the marked zone. The lid stays latched except during additions, which two people do together.
Management components. Monitoring: the supervisor checks zone and lid twice a shift and signs. Corrective action: an unauthorised person is removed, the batch is held and assessed, the cause is dealt with. Verification: the production manager reviews records weekly.
What training, reanalysis and records does the IA rule require?
Whoever writes, assesses and reanalyses the plan must be a qualified individual, through training at least equivalent to the FDA recognised curriculum or through job experience. Staff at actionable process steps, and their supervisors, need food defence awareness training and training in the strategies they operate. The plan is reanalysed at least every three years.
Reanalysis comes sooner when something moves:
- a significant change that creates or raises a vulnerability
- new information about potential vulnerabilities
- a mitigation strategy or plan found not to be properly implemented
- an instruction from FDA
Records are where a foreign site is usually weakest: the plan is signed and dated by the owner, operator or agent in charge, at completion and at every modification, and monitoring, corrective action, verification and training records must be retained, in general for at least two years after they were prepared.
Can one food defence plan satisfy TACCP, the GFSI schemes and the FDA?
In most cases, yes. Keep the PAS 96 threat assessment as the front end: FSSC 22000, BRCGS, SQF and IFS auditors expect one, and it covers threats outside the FDA rule’s scope. Then add the process step layer.
1
Evaluate every step
Write down why each step on the HACCP flow diagram is or is not actionable.
2
Three columns per strategy
Monitoring, corrective action, verification.
3
Record the reanalysis
An annual review of the whole plan, recorded as a reanalysis, beats the three year limit.
4
Answer question 14 plainly
The status you have confirmed, the steps, the strategies. Do not claim compliance you have not checked.
Our post on what a food defence coordinator does describes the role that holds this together. If the questionnaire also asks how you monitor fraud risk in raw materials, see food fraud horizon scanning and supplier certificate verification.
What does the Food Defence Coordinator Course cover, and what does it cost?
The Food Defence Coordinator Course is 10 hours of expert level, self paced online study for R1 750. It is built on TACCP and PAS 96:2026 and mapped to FSSC 22000, BRCGS, SQF, IFS and 21 CFR Part 121.
Course facts
| Course | Food Defence Coordinator Course: TACCP, FSMA and the Food Defence Plan |
|---|---|
| Provider | ASC Food Safety Training |
| What you leave with | Your own completed threat assessment, marked by a person with coaching notes, to download and keep |
| Level | Expert |
| Time | 10 hours, at your own pace |
| Price | R1 750 |
| Format | Online, self paced, lifetime access. Five modules. |
| Assessment | No exam. A graded practical: four threat pairings scored online, marked by a person against a rubric, coaching notes, second attempt. |
| Certificate | Certificate on completion |
| Who it is for | Whoever coordinates the site food defence plan, including at sites exporting to the United States |
Enrol in the Food Defence Coordinator Course, R1 750
Questions people ask before they enrol
How long does the Food Defence Coordinator Course take?
About 10 hours of self paced online study across five modules. You can stop and continue whenever it suits you, and access is for life, so module 5 is still there the next time an importer’s questionnaire arrives.
What does it cost, and can I pay from outside South Africa?
R1 750, paid once by card or EFT through PayFast. Prices are in rand. An indicative USD, EUR and GBP equivalent is shown on the course page, and payment settles in rand.
Is there an exam?
No. In module 4 you score four threat pairings on the Mzansi Fresh Meals training case online. A person marks your work against a rubric and sends coaching notes, you get a second attempt, and you download your own completed threat assessment.
Do I need food defence experience, or a site to practise on?
The course is expert level, but module 1 starts with the basics: a threat is not a hazard, the Food Defence Team and the site information you need. The graded practical uses the Mzansi Fresh Meals training case, so it works without being employed on a site.
Will the course tell me whether the FDA rule applies to my facility?
It teaches how the rule is structured and how to build a plan that answers it. It does not give legal advice on your facility. Confirm your registration status, size category and any exemption with your US importer or FDA.
The questionnaire has a return date. One export customer who moves the order because question 14 came back vague costs far more than R1 750 and 10 hours. To answer from a plan you understand, enrol in the Food Defence Coordinator Course on TACCP and the FDA food defence plan today. The introductory route is on the food fraud and food defence training hub.
PAS 96 is published by BSI. 21 CFR Part 121 is a US Food and Drug Administration regulation. This course is an independent training product and is not approved or endorsed by BSI, FDA, any scheme owner or any certification body.