In SQF the saying goes:
"Say what you do - do what you say - prove it."
A month ago I told my client we needed to do a breach exercise to test their food defense program.
This was met by - but, we have everything we need in place to prevent that from happening...
I said, great - let's test it and on top of that it's a requirement of SQF.
You can have all the all the "say what you do" documentation you want.
And, you can have all the "do what you say" in place like camera's, locks, electronic gate control, sign-in and sign out books, GMPs for visitors, guards etc and even training on food denfense, how to stop people from entering that building that should not be there, etc. etc. etc... it's this part that is the issue --
If you can't prove it - you do not have food defense, you can add all the safeguards you want, spend thousands on locking systems, automatic gates, etc.
But if nothing you do actually works to protect your company, food/product, employees, etc it means nothing, nada, jack-poop!
It took a while to convince even the president of the company to do a breach exercise - but finally they gave in --
OH MY - TALK ABOUT ABSOLUTE FAILURE!
This is why you do challenges to your food defense and other programs...
The person selected to run a breach was the neighbor of one of the managers at the company.
The neighbor runs a roofing company and mentioned that he had a job to do in the same neighborhood as the company during the following week.
So, it's a Wednesday morning when the man finished up his work at a nearby business and proceeded in his van (that has his logo and advertising on it.) to the company.
He drives up to the gate that is controlled with a camera and intercom system - the receptionist sees him and has a full view of the side of his truck. She asks him thru the intercom what he is here for and he answers that Mike asked him to stop by to do an estimate on fixing the roof... she pops the lock and the gate slides open... he pulls in to the rear of the facility.
>The receptionist knows who the approved service providers are, their photo's are right on the entry procedures screen, since he was NOT on the provider list but mentioned the name of the person that wanted the estimate she should have had him back up, pull into the front parking lot and proceed to the 2nd floor reception area to sign-in, show a government issued Id and read a visitor gmp sheet at the same time Mike should have been contacted to meet him at reception and then escort him in the building.
He drives to the rear of the building and enters the building at a man-door that opens to the shipping/receiving office/area, he's got a clipboard, camera and pen in hand - two people in the small office look up say hello and he keeps on walking. He proceeds down the long hall between the refrigerators and production rooms passing the janitor who asks what he is there for and the guy says I need to check the wall area over there for a leak from the roof - the janitor says, oh that's good and the man proceeds on his way. He's got an assistant with too by the way.
While standing at a wall about 200 feet from where he came in, two people (supervisors) say hello and one mentions they need to put hairnets on. The supervisors continue their way, the breachers go their way and enter the tank room where live product is in water filled vessels.
From there they enter a production area where product is open and being processed -- one of the supervisors in that area informs them they need to get out because they don't have hairnets on to which they say ok, where are those and the supervisor says they are by the shipping office.
They leave this area and go into the ice room, then the lunchroom, use the bathroom and then proceed to the 2nd level of the warehouse and look around and then back down and are able to go over to 2 works packing whole tuna's into iced coffins for shipping, one of the works lets the guy put his hands on the side of the tuna.
They proceed from there to the exit gate and it is popped open for them.
All systems and all personnel failed to prevent what could have been a really bad situation.
Do you see the importance of challenging your defenses?
Yes, massive training - system reviews - all of the above.