Granting access
By far, people pose the greatest threat. Controlled access is the best defense when it comes to managing people entering the facility and moving throughout it. Typically, bakeries must manage access for four kinds of people: employees, vendors, visitors and drivers. Each category should be assigned access authority.
The people with the most access are going to be the most difficult to defend against — namely, the disgruntled employee.
“This is probably the most difficult risk to minimize because they’re authorized to be in the plant, and they could easily bring a contaminant with them,” Mr. Carr said.
Keycards or biometric controls such as fingerprint scanners can identify who is in what part of the plant and, thus, can restrict access to specific areas. They also record how people move throughout the bakery. Some places need only a locked door. In other locations, turnstiles can help keep people entering the bakery in an orderly fashion and prevent outsiders from slipping in behind employees.
Employees also can be great allies when it comes to detecting threats from outsiders.
“People in your facility need to be vigilant for food defense,” Mr. Heflich said. “They should know that they have a responsibility to confront people on the premises who they don’t know.”
It gets tricky with vendors and contractors because they require some access to the facility but don’t need total access.
“Contractors are difficult to control because plant management doesn’t know who they are,” Mr. Carr said.
For example, technicians are granted access to work on the HVAC system, but they can be strangers moving throughout the plant.
Mr. Carr suggested the bakery supply temporary ID cards to outsiders with legitimate business at the plant. Many technicians and vendors will have IDs from their employers, but one issued by the bakery has the advantage of vetting by the bakery itself.
Another primary line of defense is the entryway. All entrances should be locked and monitored, but in the case of visitors, especially potential customers, how does a bakery maintain security while also feeling welcoming?
“When you’re visiting a bakery, sometimes there is just a vestibule and a phone to gain entry,” Mr. Koury said. “It’s a challenge, being secure but welcoming. Nothing beats putting a staffer in a chair at the reception area.”
This person can also serve as the point of contact not just for visitors and clients but also deliveries, vendors and service calls.
A particularly weak place in the bakery for security is shipping and receiving. Here, ingredients and supplies are dropped off and products shipped out. Employees interact with drivers at the front and back ends of the operation. While some companies manage the main entrance with just a vestibule and a phone, they need employees supervising shipping and receiving.
“If you don’t have someone checking deliveries, you’ll end up having delivery drivers or service techs just walking into the building through the shipping and receiving dock,” Mr. Koury said.
Drivers don’t need much access to the building. Mr. Carr suggested restricting their access as much as possible. Build isolated restrooms for drivers to use. Conduct the transaction through a pass-through window. Incorporate a quarantine area for inspecting non-bulk ingredients before taking them inside the plant. Ensure outside ingredient storage tanks and silos are visible from the inside by the bakery’s employees.
“You don’t want a driver somewhere on the back of the building, where no one can see him to know if he’s unloading ingredients properly,” he said.
And again, Mr. Carr expressed the importance of bakery-issued IDs.
“Thus, the outsiders don’t even get to unlock the cap from the truck unless they show the ID,” he said.
All of this may sound a bit complicated, but it’s important to remember that FSMA requires each bakery understand its risks and mitigate and manage them in a reasonable way for their specific operation. For an existing plant, that may require security cameras, training and documentation. For a brand new plant, that may mean a central security system, biometric locks, quarantined ingredient receiving and isolated areas for delivery drivers.
But, it’s all worth it to protect the end-user.
“We do this because we care about the consumer and our brands,” Mr. Carrillo said. “Because, at the end of the day, we are also consumers and so are our families.”
