Two examples I've seen/experienced have been the person unknown and a package unknown.
In 2023 we did a corporate QA team visit to one of our sites, and I got to play the person unknown and try to get into the plant. They almost won straight off: all outside doors were locked, I couldn't access the roof, and the one door for delivery drivers was properly defended with personnel and sign-in sheets (they wouldn't let me pass). But then I got to the main office door, keypad lock, and the second code I tried was 1-2-3-4 and it popped open. Front desk was unmanned because it was too early for office staff, so I waltzed on by. I made it into a storage area where extra smocks and hard hats were kept, grabbed a blue hardhat indicating I was a new trainee, and proceeded to walk the plant for 40 minutes unchallenged. Started off trying to be sneaky, but eventually I was walking up and down the lines with my phone out, taking photos and checking my Fantasy Football for updates. The saving grace was that multiple employees reported me to their supervisors, supervisors radioed to management, but they were told not to worry because I'm on the visiting corporate team. I wrote a report documenting the frontline employees did their job well enough, but senior management dropped the ball, root cause was they allowed one of the most common 4 digit codes to be used on a door (google it, there's a list of common codes to be avoided).
That plant last year had done a package unknown challenge. QA Manager snuck a box into the pile of UPS/FedEx packages that are normally first received on a cart near the docks. Package was stickered as a biohazard, hand addressed to a boss by a former employee, etc., all sorts of red flags to simulate a disgruntled employee sending a malicious package. QA Manager timed how long it would take to get reported, observed what receiving employees would do when discovered via the security cameras. Took them like 6 minutes to discover, pull personnel out of the dock area and report the package to the facility management.
Really think of anything that's out of the norm and violates your food defense plan. Have a manager not normally associated with production ask to throw a box onto a pallet of finished goods that are about to be loaded onto a truck, purposely dodging questions about what's inside (or say something like "this customer peed me off, I'm going to send them a little 'extra' gift, heh heh"). This simulates employee sabotage of the foods. Have someone approach employees on their lunch break outside and ask them to open the door for him. This is one area where, IMO, auditors become a little gitty and like to see outside the box thinking, and it leads to some fun conversations.
