Existing Food Safety Statutes Do Not Provide Sufficient Authority to Regulate All Aspects of Security at Food- Processing Facilities

The food safety statutes do not specifically authorize FDA or USDA to  require food processors to implement any type of security measures  designed to prevent the intentional contamination of the foods they  produce. While these agencies’ food safety statutes can be interpreted to  provide authority to impose certain security requirements, as opposed to  food safety requirements, neither agency believes it has the authority to  regulate all aspects of security. USDA’s general counsel concluded  that to the extent that security precautions pertain to activities closely  related to sanitary conditions in the food preparation process, FSIS has  the authority to require food processors to implement certain security  measures. On the other hand, USDA believes that the “outside security” measures  included in its guidelines, such as securing plant boundaries and providing  guards, alarms, and outside lighting, have little to do with sanitation in the  facility or the immediate food-processing environment and, therefore,  could not be made mandatory under existing authorities. FDA and FSIS Issued Voluntary Security Guidelines to Food Processors but Do Not Track or Document the Extent to Which They Are Being Implemented

In response to the nation’s growing concerns regarding the potential for  deliberate contamination of the food supply, FDA and USDA issued  guidelines to the food-processing industry suggesting measures to enhance  security at their facilities. Although both agencies have  alerted their field inspection personnel to be vigilant about security issues,  they have also told the inspectors that they are not authorized to enforce  these measures and have instructed them not to document their  observations regarding security because of the possible release of this  information under the Freedom of Information Act and the potential for  the misuse of this information. However, both FDA and USDA have instructed  their field inspection personnel to refrain from enforcing any aspects of  the security guidelines because the agencies generally believe that they  lack such authority. Recently the agency modified its position regarding direct discussions of  food security and now allows inspectors to discuss, but not interpret,  security with facility management. Inspectors are still instructed not to  document these conversations or enforce the adoption of any security  measure. FDA and FSIS Survey Respondents Indicate That Processing Facilities Are Implementing a Range of Security Measures

FDA and FSIS survey respondents observed a range of security measures  being implemented at food-processing facilities, although both FDA and  FSIS respondents were able to provide more information about those  security measures that were most visible during the course of their normal  inspection duties. 3.) Both FDA and USDA have  completed risk assessments. Finally, the lack of security training for FDA food inspectors on the  voluntary security guidelines issued for food processors and the limited  number of FSIS inspectors that have so far received training on the  voluntary security guidelines hamper the inspectors’ ability to conduct  informed discussions regarding security measures with facility personnel  as they are currently instructed to do. FDA agreed with our  recommendation that it provide all food inspection personnel with training  on security measures. We also believe that possessing such information is important if it  becomes necessary to advise food processors on needed security  enhancements. Appendix I: Scope and Methodology

To determine the extent to which the current federal food safety statutes  can be effectively used to regulate security at food-processing facilities,  we analyzed the Food and Drug Administration’s (FDA) and the U.S.  Department of Agriculture’s (USDA) existing statutory authorities.
Why GAO Did This Study

The events of September 11, 2001, have placed added emphasis on ensuring the security of the nation's food supply. GAO examined (1) whether FDA and USDA have sufficient authority under current statutes to require that food processors adopt security measures, (2) what security guidelines FDA and USDA have provided to industry, and (3) what security measures food processors have adopted.

What GAO Found

Federal food safety statutes give the Food and Drug Administration (FDA) and the U.S. Department of Agriculture (USDA) broad authority to regulate the safety of the U.S. food supply but do not specifically authorize them to impose security requirements at food-processing facilities. However, these agencies' food safety statutes can be interpreted to provide authority to impose certain security measures. FDA believes that its statutes authorize it to regulate food security to the extent that food security and safety overlap but observes that there is little overlap between security and safety. USDA believes that it could require food processors to adopt certain security measures that are closely related to sanitary conditions inside the facility. USDA also believes that the statutes, however, cannot be interpreted to authorize the regulation of security measures that are not associated with the immediate food-processing environment, such as requiring fences, alarms, and outside lighting. Neither agency believes that it has the authority to regulate all aspects of security at food-processing facilities. Both FDA and USDA issued voluntary security guidelines to help food processors identify measures to prevent or mitigate the risk of deliberate contamination. Because these guidelines are voluntary, neither agency enforces, monitors, or documents their implementation. Both FDA and USDA have asked their inspectors to be vigilant and to discuss security with managers at food-processing facilities, but the agencies have stressed that inspectors should not enforce the implementation of security measures or document any observations because of the possible release of this information under the Freedom of Information Act and the potential for the misuse of this information. Since FDA and USDA do not monitor and document food processors' implementation of security guidelines, the extent of the industry's adoption of security measures is unknown. According to officials of trade associations and the five facilities we visited, however, food processors are implementing a range of security measures. In addition, the FDA and USDA field inspectors we surveyed indicated that most facilities have implemented some security measures, such as installing fences. However, the inspectors were less able to comment on security measures that were not as obvious, such as accounting for missing stock and implementing proper mail-handling practices. The inspectors also noted that while USDA has provided some of its field supervisory personnel with security training on the voluntary security guidelines it issued, it has not provided most of its inspectors with such training. FDA has not provided its staff with any training on the security guidelines. Without training on the security guidelines, inspectors are limited in their ability to conduct informed discussions regarding security with managers at food-processing facilities.