Food Protection Trends - September 2009 - 573

diminishing or interrupting the food supply (which has its own public health implications), and (2) to provide for fast and effective recall of dangerous products should the first constraint somehow be violated. Using these constraints, general requirements can be derived for the “engineered” system, such as (1) health regulation standards must be established, (2) food producing and processing facilities must be certified and inspected for compliance with the standards, and (3) a system must exist for identifying, tracking, and recalling dangerous products, etc. The goal for engineering our food safety system is to design a control structure that will implement the identified requirements. Figure 1 shows a simplified control structure for the US food safety system. Each component of this structure has its own responsibilities with respect to the overall system responsibility (safety constraints). For example, the official responsibiliies of the FDA (1) are to: • regulate all food and foodrelated products, except for a few items that fall under the jurisdiction of the USDA (e.g., processed egg products, meat and poultry products). ensure the safety of the production, processing, packaging, storing and holding of all domestics and imported foods, except for those products that are under the jurisdiction of the USDA. approve new food additives and monitor ingredients and foods to see that they are contaminant free. inspect plants and keep track of what each plant manufactures. Controls Each component of the food safety system has potential controls and control actions it can use to execute its responsibilities. Reengineering requires understanding the controls currently in place and, if necessary, designing more effective ones. The FDA, for example, can impose standards, conduct inspections, etc. A limitation of the potential FDA controls is that the agency does not have the power to initiate a food recall. Note that controls need not be draconian, external measures. In engineering, component failures and unsafe interactions may be “controlled” through system and component design (e.g., redundancy, interlocks, fail-safe design) or through process (manufacturing processes and procedures, maintenance processes, operations), or through social controls. Social controls, in turn, need not necessarily be governmental or regulatory; they may also be cultural, policy, or individual (self-interest). As an example of the latter in our current financial crisis, when investment banks went public, individual controls to reduce personal risk and long-term profits were eliminated and risk shifted to shareholders and others who had few and weak controls over those taking the risks. Food producers and manufacturers, who have the most actual control over the safety of the food supply, may be motivated by the need to maintain their customers and thus stay in business or simply through moral considerations. Some controls may be more or less effective than others, and their effectiveness can change over time. Controls must be designed and implemented throughout the whole system, not just on some of the components, and the communication channels for information and feedback must be in place and operational. Losses occur when the controls are inadequately designed or they degrade over time. • • • As another example, the responsibilities of paid inspectors are to: • inspect food manufacturing plants to ensure they meet the standards provided by the appropriate regulatory agencies. provide inspection reports to the plant owners indicating any compliance issues related to the appropriate regulatory standards. Influences, pressures, and changes over time An underlying assumption of STAMP is that most people do not act with malevolent intent but instead are operating under pressures and perhaps with inadequate knowledge that can lead to actions that are contrary to public health. Major accidents often result from a slow migration of the system due to competitive and economic pressures (10, 14) that result in a state of unacceptable risk. Usually nobody intends to harm other people, but these pressures can lead to taking larger risks or inadequately executing responsibilities. Because of various contextual and stress factors, the behavior of the enforcers of regulatory and other controls • When losses occur, either some or all of the food safety system components did not fulfill their responsibilities, or the overall design of the system (the design of the components and their responsibilities) does not adequately fulfill the system goals and needs to be redesigned. over food safety will tend to change over time. In addition, structural changes may be made to the system without adequate consideration of the implications of the change on the various system components’ ability to oversee and control safety. One factor in the E. coli O157:H7 contamination of the water supply of a small town in Ontario, Canada, was the privatization of the government water testing laboratory without establishing feedback loops from the private labs to the government overseers of the water system to detect when operating conditions were degrading (11). This flaw in the altered water system safety control structure is similar to limitations in the US food safety control structure in that the FDA does not have access to data provided by inspectors hired by the manufacturers. This flaw becomes clear once the system is viewed as a control structure, as illustrated in Figure 1. It is the responsibility of the safety control system to prevent migration to unacceptably high states of risk (i.e., unacceptable safety system component behavior) or to detect when it is occurring and respond appropriately. So, reengineering the food safety system (or any socio-technical system) requires understanding the context in which decision making takes place, particularly those factors that militate against a controller providing the control necessary to successfully fulfill its responsibilities. For example, food safety has to compete with other governmental priorities (e.g., healthcare, the environment, national defense, education) when Congress determines funding levels for the government food regulatory agencies and the disease detection structure. Food safety is only one of the FDA’s responsibilities, which can lead to difficult decision-making about allocation of resources within the agency. As another example, while plant safety inspections are typically required by the companies that purchase raw products, external inspectors are typically paid by the owners of the plants they are inspecting, and there is no standard procedure the auditors have to follow when inspecting a plant. In addition, plant inspection is a competitive business. Forhire inspectors can lose business when they provide a poor grade to a plant or a negative test result, or plant managers can switch companies to get the results they want. In return, the food industry is competitive, which leads to cost cutting pressures, and food producers are for-profit companies. The number of food producers is very large, making it difficult to provide much state or federal oversight. SEPTEMBER 2009 | FOOD PROTECTION TRENDS 573

Food Protection Trends - September 2009

Table of Contents for the Digital Edition of Food Protection Trends - September 2009