Hi Jean-C,
To test your Crisis Management Procedures you need to create an incident scenario and follow through to check* out the procedures/system. Incidents may include:
• disruption to key services such as water, energy, transport, refrigeration processes, staff availability and communications
• events such as fire, flood or natural disaster
• malicious contamination or sabotage
• product contamination indicating a product may be unsafe or illegal
• failure of, or attacks against, digital cyber-security.
* Your test should demonstrate that the system works, highlight any gaps/need for improvement and act as a training exercise for personnel to ensure that roles and responsibilities are understood.
Some more relevant info from BRCGS Global Standard Food Safety Issue 9 clause 3.11.1 Guidance Documented incident and emergency procedures:
A documented incident management procedure is required. Although it may not be possible to detail exactly what action will be taken, as this will depend on individual circumstances, the company should consider:
• standard responses to a range of potential disasters, such as fire, flood or the loss of essential services
• the provision of alternative resources for energy, water, transport and any potential options for subcontracting production
• how to handle acts of potential malicious contamination or extortion
• management of unsafe or illegal products; for example, due to contamination or authenticity concerns
• details of staff responsibilities, including which staff are authorised and responsible for making decisions relating to non-conforming products. The number of incident management team members should be appropriate for the size of the business
• a plan to handle the logistics of product traceability and the recovery or disposal of affected product and stock reconciliation (i.e. comparing the amount of implicated product with the amounts known to have been destroyed, returned or retained in storage)
• methods to communicate with key contacts, both internal and external, such as telephone and email contact details (including office hours and out-of-hours details)
• the communication process, and the way in which enquiries from customers and the media are handled (this can be critical to the effective management of the situation and ultimate business recovery)
• corrective action that needs to be taken before production can recommence
• root cause analysis and preventive actions. Sites should reference their root cause procedure (clause 3.7.1), so that relevant preventive actions can be completed
• procedures to withdraw or recall affected products.
Kind regards,
Tony