13 replies to this topic

[bacon]

Our Business Continuity Plan is OK, it goes through many possible scenarios, Senior Management involvement, contacts, etc.
However,

SQF 2.1.6.3 - The business continuity plan shall be reviewed, tested and verified at least annually.


Does anybody have any experience on how to "test" ones Business Continuity Plan? Perhaps with a "Mock Crisis"?

Not sure how to actually do an actual "Mock" crisis out of the following:

Type of Emergency

Loss of cooling after processing / Power Outage
Product temperature to be maintained at or below 40°F, temperature is not to exceed 45°F for more than an hour. If product reaches temperature of more than 45°F, disposition of product would be determined case by case. A food safety risk analysis shall be performed prior to making this determination. A corrective action will be completed concerning the hazard.

Chemical exposure
Product shall be discarded if there is any evidence or suspicion that products may have been exposed to any chemical contamination such as oil, grease, sanitation chemicals, etc. A food safety risk analysis shall be performed prior to making this determination. A corrective action will be completed concerning the hazard.

Fire and /or smoke damage
Product shall be discarded if there is any evidence or suspicion that product may have been exposed to fire and/or smoke.
Any affected water systems shall be drained, cleaned, sanitized, and recharged with fresh water. A food safety risk analysis shall be performed prior to making this determination. A corrective action will be completed concerning the hazard.

Blood, fecal, or bodily fluid exposure.
Product shall be discarded if there is any evidence that product may have been exposed to any blood, fecal material, or bodily fluids.
A food safety risk analysis shall be performed prior to making this determination. A corrective action will be completed concerning the hazard.

Flood water
Products shall be discarded if there is any evidence or suspicion that they may have been exposed to flood waters.
A food safety risk analysis shall be performed prior to making this determination. A corrective action will be completed concerning the hazard.

Any thoughts?
Cheers,
-C

[GMO]

I have done two recall / BCP tests and I did them both on food safety issues. What I did was start the process with a pretend phone call and then give slips of paper with updates on to the team. I didn't take part because I figure that it's just blooming luck that when you have a real crisis, the Technical Manager is on holiday. I made the crisis have an obvious end point which you could lead towards but also tested their knowledge of legislation.

For your examples, perhaps you could have a situation where you do it over a longer time period? Maybe alert the team at 9am that there is local flooding and more rain is forecast then at 11am have the water close to the door, at noon it's coming under the front door... you see how you can build it up? It's important in the scenarios you've raised to see what the early actions would be because if they've done nothing by the time the water is under the door I would say they've failed the challenge.

Another easy one could be to even act out a major accident with blood spillage (warn people and you could be the pretend casualty or rope in an operator.) Specify the range of the blood spillage and see what happens (I bet they forget the H&S side and concentrate on the food safety!)

I have to admit I really liked doing this kind of thing and I had some very positive feedback about it. What's most important once you have all of the results is to talk through with the people involved what happened, what went well, what didn't, what would they change, was the documentation they had a help or a hindrance etc.

[Katja]

In a course i took the auditor mentioned doing a fire drill or pretend power outage. The company the auditor had audited had turned off the main power and switched on the generator only to find out the generator did not work and it had not been covered in the preventative maintenance plan. Last year we had a pretend water boil advisory from our municipal water supply.

good luck

[HACCP Mentor]

What ever scenerio you decide to use, remember to go back to the basics of "what do we want to achieve out of this process". The reason to test the system is to make sure if it really happens you will be as prepared as possible. In saying this, you should be testing all of your procedures around your emergency management and contingency planning.

Other scenerios to consider include (just a few off the top of my head):

What would you do if half your work-force coulden't show up to work tomorrow because of bird-flu or some natural disaster?
What if your major raw material supplier went into adminstration tomorrow?
What if the truck that transports your product to market rolled on the free-way and killed other motorists?
What if a disgruntled employee started sabotaging your product that then gets released to the market?

You need to consider not just the food safety aspects but also the damge to brand and your business.

Customers who require SQF as a basis of doing trade what to know that their own supply chain is safe and able to provide at all times.

Just a few things to consider so I hope it helps.

Cheers

Amanda

[bacon]

Thanks all!

This being the company's 1st go at it, I thought, to break them in, do a crisis they have already gone through: Power Outage.

I'm having the meeting about it today (they will know the detailed that will be filled in), but here is what I wrote up to start with (we are in the RTE produce processing industry):
_______________________________________________

This will be an email to orchestrate the communication emails and “summaries” of phone calls in these emails to act as “evidence” of our Mock Crisis.

A) Power Outage threat: loss of temperature control.
B) Possible solutions:

1) Power Generation:
a. for temp. sensitive rooms
i. Storage
ii. Processing

2) Product Relocation:
a. Storage
b. Processing
c. Transporting
i. Temp monitoring

Identify Stake Holders and send email to explain: Mock Power Outage

1) Who is first to notify issue to “kick-off” incident”
a. Identify Scope (the area of power outage)

2) Who is part of Senior Management Involvement
a. Corporate vs. Plant


3) Who is communicated to for:

a. Product transport:
i. Who to contact for Capacity

ii. Who to contact for Time

iii. Who to contact for Transport logistics
1. Physical shipping times
2. Temp monitoring

iv. Who to contact for Destination logistics
1. Physical receiving times
2. Temp monitoring

b. Possibility of alternative location processing.

i. Who to contact to identify what products?
1. Who in Production
2. Who in Sales
a. For what customers (not affected by power outage).

[bacon]

Just occurred to me discussing this on another forum:
The SQF Guidance doc suggest this mock crisis: "An annual review should have similar aspects to a mock recall." implying something other than a mock recall.

However, Issue 7:


1.9 SQF Guidance Documents
(page 23)

"The guidance documents are available to assist the supplier, but are not auditable documents. Where there is a divergence between the guidance document and the SQF Code, the SQF Code prevails."


Hence, ignore the Guidance Doc and a mock recall will suffice as a mock crisis/incident (and hit 2 birds with one stone).
We do 2 mock recalls annually.

I am a BRC guy (not required by BRC issue 5 as I remember) so this "mock crisis" other than a recall threw me off a bit.

Food for thought...

[Charles.C]

Dear baron,

The SQF Guidance doc suggest this mock crisis: "An annual review should have similar aspects to a mock recall." implying something other than a mock recall.

I suspect many people wud interpret this as simply yet another mock recall. My guess is that SQF realised that by originally asking for a "crisis" they had created a disaster but were reluctant to backtrack.

"A rose by any other name ......"

Rgds / Charles.C

[HACCP Mentor]

A mock recall and mock crisis are two very differentthings. A recall relates to testing the traceability and removal off affectedproduct from the market-place where a mock crisis is about testing businesscontingency procedures. See my previous post above on sample crisis scenarios.I am both a BRC and SQF auditor, and when we review this in audits we arelooking for two very different things. There may be some confusion around thefact that sometimes what starts off as a product recall can eventually end in acrisis. The business procedures will be different in what aspect of thebusiness gets involved and the level of reporting that needs to occur.

[bacon]

I am indeed finding inconsistencies with my colleges and what their auditors (BRC & SQF) are accepting as a "mock incident" or "Crisis".

I certainly agree with HACCP Mentor and others (and our BCP reflects this), however, per the SQF Code:


2.1.6.1
A business continuity plan based on the understanding of known food safety threats to a business shall be prepared by senior management outlining the methods and responsibility the organization will implement to cope with a business crisis that may impact on the ability of the supplier to deliver safe food.

and

2.1.6.2
The business continuity plan shall include as a minimum:

i. A senior manager responsible for decision making, oversight and initiating actions arising from a crisis management incident;
ii. The nomination and training of a crisis management team;
iii. The controls implemented to ensure a response does not compromise product safety;
iv. The measures to isolate and identify product affected by a response to a crisis;
v. The measures taken to verify the acceptability of food prior to release;
vi. The preparation and maintenance of a current crisis alert contact list;
vii. Sources of legal and expert advice; and
viii. The responsibility for internal communications and communicating with authorities, external organizations and media.


All this does not preclude a "Mock Recall" as it is indeed a threat that "may impact on the ability of the supplier to deliver safe food".

I do not mean to be bureaucratic about this,our BCP does mention all of the other examples of Typical Emergencies (Loss of cooling after processing / Power Outage,Chemical exposure, Fire and /or smoke damage, Flood water, etc) and "execute procedures related to recall and other crisis situations".

We happen to use a Mock Recall to address:

2.1.6.3
The business continuity plan shall be reviewed, tested and verified at least annually.



Note:
To have a fall back, we do have a recent real documented actual power outage and how our BCP applied with provided evidence:
1) a timeline of events correlated with:
a. records QA records (SSOP’s,Temp Logs, Wash Logs),
b. emails and
c. city government event info

P.S. -
And again I would like to mention on page 23 of SQF Code (issue 7):

"1.9 SQF Guidance Documents: The guidance documents are available to assist the supplier, but are not auditable documents. Where there is a
divergence between the guidance document and the SQF Code, the SQF Code prevails."

[D-D]

That SQF wording makes it sound more useful but in general I thought a "business continuity plan" was just that i.e. how would the business continue (to serve the customers) in the event of a disaster (and is therefore much the same as the crisis management procedure)?. This has always made me smile as in reality if the factory blew up, yes we probably would call the customers first thing to say they weren't going to get their product on time but continuing the business for their sake is not going to be the priority. Who is going to pick up the Quality Manual and look through it to see what it says? I bet many companies would do a stock take on their situation and may decide a totally different strategy on what to do with that insurance money and emerge as a quite different business. Or even just retire to the Bahamas. The BCP therefore seems to become something of a trendy thing to have and reminds me in many ways of an iPhone 5: Everybody says you need one but nobody really knows what to do with it when you have it.
Recall procedure: a definite must-have that has to be practiced to make sure all the traceability and contact info etc is in place and working...

[esquef]

I have to agree with HACCP Mentor's comment:

"A mock recall and mock crisis exercise are two very different things. A recall relates to testing the traceability and removal of affected product from the market-place where a mock crisis is about testing business contingency procedures."

The two are essentially independent of each other. I suppose you could link them (e.g. you had a crisis, say for example a flood, and some potentially affected product wasn't identified and put on hold and subsequently found to have been shipped to customer(s). You could then do your Mock Recall exercise to show how that product was traced and recalled. I definitely don't see any advantage in linking the two exercises, however. You could just open a can of worms for the auditor (for example this might be valid for a "1 forward" trace but not for a "1 back" in the auditor's opinion).

IMO a Mock Crisis Exercise (a.k.a. Business Contingency Plan) should be kept as simple as possible for your SQF audit. If your policy, procedures and responsibilities have been written to comply with the code, my experience is to come up with a crisis like a flood, power outage, storm damage, fire, etc. and simply gather the Crisis Team together and go through the exercise chronologically, documenting events (communication to you legal counsil, media, employees, regulatory authorities, customers, etc.) as they happen, planning and decision making re. getting your company up and running, and most importantly describing (documenting) how potentially affected product (raw materials, WIP, finished product, and packaging) would be evaluated by qualified personnel in order to determine the disposition of these materials.

[mrsflamer]

A quick question on the topic of BCP...we are having our first ever audit to become SQF certified (within the next month). Is the testing of the BCP expected to be done prior to the desk audit, or prior to the facility audit?

[HACCP Mentor]

A quick question on the topic of BCP...we are having our first ever audit to become SQF certified (within the next month). Is the testing of the BCP expected to be done prior to the desk audit, or prior to the facility audit?

Yep...it sure is (I know the date is way past....but this may be beneficial for others to know in the same situation)

[bacon]

Just a quick note, make sure you have the Crisis Management Team that go thought your "mock Crisis" sigh off on your "crisis management policy/procedure" for the training requirement (even though they may have wrote the policy/plan).

We just got a minor NC for that...