U Marketing and

Regulatory

Programs

Agricultural

Marketing

Service

Specialty

Crops

Program

Specialty 

Crops 

Inspection

Division

AIM 

Inspection

Series

Food Defense (FD) Audit 

Standard

June 2022
“SCI moving forward in the 21st Century using technology, innovation, and old fashioned hard work”

Non-Discrimination Policy: In accordance with Federal civil rights law and U.S. Department 

of Agriculture (USDA) civil rights regulations and policies, the USDA, its Agencies, offices, and 

employees, and institutions participating in or administering USDA programs are prohibited 

from discriminating based on race, color, national origin, religion, sex, gender identity (including 

gender expression), sexual orientation, disability, age, marital status, family/parental status, 

income derived from a public assistance program, political beliefs, or reprisal or retaliation for 

prior civil rights activity, in any program or activity conducted or funded by USDA (not all bases 

apply to all programs). Remedies and complaint filing deadlines vary by program or incident.

Persons with disabilities who require alternative means of communication for program 

information (e.g., Braille, large print, audiotape, American Sign Language, etc.) should contact 

the responsible Agency or USDA's TARGET Center at (202) 720-2600 (voice and TTY) or 

contact USDA through the Federal Relay Service at (800) 877-8339. Additionally, program 

information may be made available in languages other than English.

To file a program discrimination complaint, complete the USDA Program Discrimination 

Complaint Form, AD-3027, found online at How to File a Program Discrimination Complaint

and at any USDA office or write a letter addressed to USDA and provide in the letter all of the 

information requested in the form. To request a copy of the complaint form, call (866) 632-

9992. Submit your completed form or letter to USDA by: (1) mail: U.S. Department of 

Agriculture, Office of the Assistant Secretary for Civil Rights, 1400 Independence Avenue, SW, 

Washington, D.C. 20250-9410; (2) fax: (202) 690-7442; or (3) email: program.intake@usda.gov. 

USDA is an equal opportunity provider, employer, and lender.
i

Food Defense (FD) Audit Standard

Table of Contents

INTRODUCTION...................................................................................................................1

GUIDE FOR ELECTRONIC USAGE......................................................................................1

HOW TO USE THIS STANDARD..........................................................................................2

FOOD DEFENSE AUDIT STANDARD..................................................................................3

1.1 Food Defense Plan............................................................................................................3

1.2 Personnel Qualifications and Training ...............................................................................4

1.3 Vulnerability Assessment..................................................................................................7

1.4 Mitigation Strategies.........................................................................................................8

1.5 Food Defense Plan Reanalysis.........................................................................................12

1.6 Records..........................................................................................................................15

REFERENCE LINKS............................................................................................................18
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 1 of 18

INTRODUCTION

This document is designed to give guidance to Specialty Crops Inspection Division personnel of 

the United States Department of Agriculture (USDA), Agricultural Marketing Service (AMS), 

Specialty Crops Programs (SC). 

Compliance with the Agricultural Marketing Service guidelines does not excuse failure to 

comply with the Food, Drug, and Cosmetic Act or any other applicable Federal or State laws or 

regulations. SCI Division is responsible for grading/inspecting, audits and standardization 

programs of fresh and/or processed fruits and vegetables and related products. The legal 

authority for grading, auditing and standardization activities are the Agricultural Marketing Acts 

of 1936 and 1946, as amended.

Applicants may obtain inspections and audits of any fresh and/or processed fruit and vegetable 

and related products for which they have a financial interest. The inspection service is voluntary 

and self-supporting and is offered on a fee-for-service basis.

GUIDE FOR ELECTRONIC USAGE 

The AIM system of instructional manuals is available electronically in Adobe Acrobat Portable 

Document Format (PDF) at the following intranet address: 

https://usdagcc.sharepoint.com/sites/ams/AMS-SCI/SitePages/Home.aspx. 

When accessed electronically, AIM materials have hyperlinks and hypertext (visible as 

underlined blue text) available to the PDF user. Clicking on a hyperlink takes the reader to a 

web site with information relating to the subject. Hypertext links the reader to a different page 

within the current manual, or a different manual, with information relating to the subject. For 

example, the hypertext in the Table of Contents allows a reader to go directly to the section of 

interest in the manual by clicking on the section title. 

PDF offers a variety of tools depending on the Adobe version the reader has. The newer the 

version, the more tools available. PDF documents are easily searchable for content within a 

document or within multiple documents. To learn about the variety of PDF search options: 

• Click on the “Help” tab on the top of any page in Adobe Acrobat, 

• Then click on the “Adobe Acrobat Help” bar, 

• Type the word “Search” in the “Search” box, and click on the “Search” button, 

• A series of options will become available, 

• Click on the “Access Search Features” link and follow the instructions for the type of 

search you are interested in.
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 2 of 18

HOW TO USE THIS STANDARD

The Food Defense Audit Standard is used as a scope as part of a Plant Systems Audit (PSA) 

Program audit. It may be used in addition to the Good Manufacturing Practices (GMP) Audit 

Standard or as a standalone scope. 

The standard includes the requirements of the Food Drug Administration Food Safety 

Modernization Act (FSMA) Mitigation Strategies to Protect Food Against Intentional 

Adulteration, 21 CFR Part 121. This rule applies to both domestic and foreign companies that 

are required to register with the FDA as food facilities under the Federal Food, Drug, and 

Cosmetic (FD&C) Act.

The standard includes the following components: 

• Requirement – a statement of the expectation for compliance to the audit standard.

• Reference – text from the cited source of the requirement.

• Citation – the source of the Reference.

• Auditor Guidance – a brief description of the evidence the auditor must find to verify 

compliance. Additional auditor guidance is in the PSA Program Auditor Manual.

• Documentation – an indication of the type of required documentation.

o Policy and Procedures – Documented guidance that describes general goals and 

acceptable specified way(s) to carry out an activity or process. Documentation 

also should identify the established forms used to show implementation.

o Record - A document that states results achieved or provides evidence of 

activities performed. Examples of records include checklists, bills of lading, 

process charts, certificates of assurance, and analytical test results. 

For instructions on use of this standard, including the associated checklist and the rating system 

for the audit outcome, please see the PSA Program Auditor Manual (in development). 

Additional information on the PSA Program can be found on the AMS website at 

https://www.ams.usda.gov/services/auditing/plant-audits. 
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 3 of 18

FOOD DEFENSE AUDIT STANDARD

1.1 Food Defense Plan

Req. No. Requirement Reference Citation Auditor Guidance Documentation

1.1.1 The facility must have and 

implement a written food 

defense plan.

The facility must keep 

documentation and records of 

the plan’simplementation.

Requirement for a food defense plan. You 

must prepare, or have prepared, and 

implement a written food defense plan.

Records. The food defense plan required by 

this section is a record that is subject to the 

requirements of subpart D of this part.

Subpart C—

Food 

Defense 

Measures

21 CFR 

121.126 (a)

(c) 

Verify that a food defense plan

has been developed and 

implemented. As you review 

implementation, confirm 

employee understanding via 

interviews, as appropriate. 

Policy, Record

1.1.2 The written food defense plan 

must include:

- The written vulnerability

assessment;

- The written mitigation

strategies;

- The written procedures for 

the food defense monitoring 

of the implementation of the 

mitigation strategies;

- The written procedures for 

food defense corrective 

actions; and 

- The written procedures for 

food defense verification.

Contents of a food defense plan.

The written food defense plan must include:

(1) The written vulnerability assessment, 

including required explanations, to identify 

significant vulnerabilities and actionable 

process steps as required by § 121.130(c);

(2) The written mitigation strategies, 

including required explanations, as required 

by § 121.135(b);

(3) The written procedures for the food 

defense monitoring of the implementation 

of the mitigation strategies as required by § 

121.140(a);

(4) The written procedures for food defense 

corrective actions as required by § 

121.145(a)(1); and

(5) The written procedures for food defense 

verification as required by § 121.150(b).

(b) Verify that the plan includes the 

required elements. It must 

include a record of the 

vulnerability assessment. The 

assessment will identify ways 

that they will prevent the 

identified risks (mitigation 

steps). The plan must 

document the mitigation 

procedures, how they will 

monitor them, the corrective 

action procedure, and the 

verification or review 

procedures.

Policy, Record
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 4 of 18

1.2 Personnel Qualifications and Training

Req. 

No.

Requirement Reference Citation Auditor Guidance Documentation

1.2.1 All facility personnel must receive 

training in food defense awareness 

(as new employee and annually).

All personnel who perform activities 

associated with food defense 

procedures must: 

- Be, or be under the supervision 

of, a qualified individual to 

perform their assigned duties, 

and

- Receive externally provided 

training on the principles of food 

defenseor have experience that 

prepares them for the assigned 

task. 

Qualifications of individuals who perform 

activities under subpart C of this part.

(a) Applicability. You must ensure that each 

individual who performs activities required 

under subpart C of this part is a qualified 

individual as that term is defined in § 121.3.

(b) Qualifications of individuals assigned to 

an actionable process step. Each individual 

assigned to an actionable process step 

(including temporary and seasonal 

personnel) or in the supervision thereof 

must:

(1) Be a qualified individual as that term is 

defined in § 121.3—i.e., have the 

appropriate education, training, or 

experience (or a combination thereof) 

necessary to properly implement the 

mitigation strategy or combination of 

mitigation strategies at the actionable 

process step; and

(2) Receive training in food defense

awareness.

Subpart A

21 CFR 

121.4

(a) and (b)

Verify that all facility 

employees have received food 

defense training. This may be 

internally delivered training for 

those employees who do not 

have direct responsibilities 

associated with the documented 

food defense procedures.

For those employees who are 

responsible for implementation 

of any of the documented food 

defense procedures, and their 

supervisors, they must receive 

externally provided training on 

the principles of food defense 

or have experience that 

prepares them for the assigned 

tasks.

The Food Safety Preventive 

Controls Alliance course on 

Food Defense Awareness is an 

example of an external course 

for general employees who are 

responsible for specific tasks. 

https://www.ifsh.iit.edu/fspca/c

ourses/intentional-adulteration

Record
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 5 of 18

1.2.2 Individuals assigned the following 

tasks must be qualified individuals:

- Preparation of the food defense 

plan;

- Completionof a vulnerability 

assessment;

- Identification and explanation of 

the mitigation strategies; and 

- Reanalysis of the food defense 

plan.

These individuals must receive 

externally provided training, specific 

to the task that they are assigned. 

Approved courses for a qualified 

individual are available on the Food 

Safety Preventive Controls Alliance 

website, 

https://www.ifsh.iit.edu/fspca/course

s/intentional-adulteration

Trainingrecords must be maintained 

for the qualified individuals.

Qualifications of individuals for certain 

activities described in paragraph (c)(3) of 

this section. Each individual assigned to 

certain activities described in paragraph 

(c)(3) of this section must: 

(1) Be a qualified individual as that term is 

defined in § 121.3—i.e., have the 

appropriate education, training, or 

experience (or a combination thereof) 

necessary to properly perform the activities; 

and

(2) Have successfully completed training 

for the specific function at least equivalent 

to that received under a standardized 

curriculum recognized as adequate by FDA 

or be otherwise qualified through job 

experience to conduct the activities. Job 

experience may qualify an individual to 

perform these functions if such experience 

has provided an individual with knowledge 

at least equivalent to that provided through 

the standardized curriculum. 

This individual may be, but is not required 

to be, an employee of the facility.

(3) One or more qualified individuals must 

do or oversee:

(i) The preparation of the food defense plan 

as required in § 121.126;

(ii) The conduct of a vulnerability 

assessment as required in § 121.130;

(iii) The identification and explanation of 

the mitigation strategies as required in § 

121.135; and

(iv) Reanalysis as required in § 121.157.

(c) Verify that the staff who have 

been assigned the formal tasks 

of developing and/or 

reassessing the food defense 

plan have training specific to 

the assigned task. The training 

must be at least equivalent to 

that received under a 

standardized curriculum 

recognized as adequate by FDA 

or be otherwise qualified 

through job experience to

conduct the activities. 

Approved courses for a 

qualified individual are 

available on the Food Safety 

Preventive Controls Alliance 

website, 

https://www.ifsh.iit.edu/fspca/c

ourses/intentional-adulteration 

Verify that records of training 

are maintained.

Record

1.2.3 Responsibility for ensuring 

compliance by individuals with the 

food defense requirements must be 

Additional qualifications of supervisory 

personnel. Responsibility for ensuring 

compliance by individuals with the 

(d) Verify education, training, or 

experience of supervisors’ 

specific job duties by reviewing 

Record
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 6 of 18

clearly assigned to supervisory 

personnel with a combination of 

education, training, and experience 

necessary to supervise the activities.

requirements of this part must be clearly 

assigned to supervisory personnel with a 

combination of education, training, and 

experience necessary to supervise the 

activities under this subpart.

training records. Ask to see any 

certificates from associated 

training.
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 7 of 18

1.3 Vulnerability Assessment

Req. No. Requirement Reference Citation Auditor Guidance Documentation

1.3.1 The facility must conduct or 

have conducted a vulnerability 

assessment for each type of food 

manufactured, processed, 

packed, or held at the facility to 

identify significant 

vulnerabilities and actionable 

process steps. Appropriate 

methods must include, at a 

minimum, an evaluation of:

- The potential public health 

impact (e.g., severity and 

scale) if a contaminant were 

added;

- The degree of physical 

access to the product; and 

- The ability of an attacker to 

successfully contaminate the 

product.

Requirement for a vulnerability assessment. 

You must conduct or have conducted a 

vulnerability assessment for each type of 

food manufactured, processed, packed, or 

held at your facility using appropriate 

methods to evaluate each point, step, or 

procedure in your food operation to identify 

significant vulnerabilities and actionable 

process steps. Appropriate methods must 

include, at a minimum, an evaluation of:

(1) The potential public health impact (e.g., 

severity and scale) if a contaminant were 

added;

(2) The degree of physical access to the 

product; and

(3) The ability of an attacker to successfully 

contaminate the product.

Subpart C

21 CFR 

121.130 (a)

Verify that as part of the 

development of the food 

defense plan, the facility has 

performed a vulnerability 

assessment for each type of 

food handled at thelocation, 

and all associated points, steps,

or procedures. Have significant 

vulnerabilities been identified?

Have steps been identified to 

reduce or eliminate the risks? 

These become the mitigation 

strategies reviewed under 1.4.

Did the assessment include 

consideration of a potential 

public health impact, the 

physical access to the product, 

and the ability of an attacker to 

contaminate product?

1.3.2 The vulnerability assessment 

must consider the possibility of 

an inside attacker.

Inside attacker. The assessment must 

consider the possibility of an inside 

attacker.

(b) Did the vulnerability 

assessment include the risk of 

an employee intentionally 

contaminating food? 

1.3.3 The vulnerability assessment 

must be documented.

Written vulnerability assessment.

Regardless of the outcome, the vulnerability 

assessment must be written and must 

include an explanation as to why each point, 

step, or procedure either was or was not 

identified as an actionable process step.

(c) Is the assessment documented 

and available for your review?

Record
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 8 of 18

1.4 Mitigation Strategies

Req. No. Requirement Reference Citation Auditor Guidance Documentation

1.4.1 The facility must identify and 

implement mitigation strategies 

at each actionable process step 

and include a written 

explanation of how the 

mitigation strategy sufficiently 

minimizes or prevents the 

significant vulnerability.

You must identify and implement 

mitigation strategies at each actionable 

process step to provide assurances that the 

significant vulnerability at each step will be 

significantly minimized or prevented and 

the food manufactured, processed, packed, 

or held by your facility will not be 

adulterated undersection 402 of the Federal 

Food, Drug, and Cosmetic Act. For each 

mitigation strategy implemented at each 

actionable process step, you must include a 

written explanation of how the mitigation 

strategy sufficiently minimizes or prevents 

the significant vulnerability associated with 

the actionable process step.

Subpart C

21 CFR 

121.135

(a)

Are the mitigation strategies 

documented in the food defense

plan as part of the vulnerability 

assessment?

Make note of the mitigation 

strategies that have been 

developed and implemented. 

Does the food defense plan

explain how it minimizes or 

eliminates the risk?

Record

1.4.2 Mitigation strategies and 

accompanying explanations 

must be written.

Mitigation strategies and accompanying 

explanations must be written.

(b) Are the mitigation strategies 

and explanations documented?

Record

1.4.3 Mitigation strategies must be 

subject to monitoring, corrective 

actions, and verification 

activities.

Mitigation strategies management 

components.

Mitigation strategies required under§ 

121.135 are subject to the following 

mitigation strategies management 

components as appropriate to ensure the 

proper implementation of themitigation 

strategies, taking into account the nature of 

each suchmitigation strategy and its role in 

the facility’s food defense system:

(a) Food defense monitoring in accordance 

with § 121.140;

(b) Food defense corrective actions in 

accordance with § 121.145; and

21 CFR 

121.138

Has the facility identified the 

ways that management will 

monitor the mitigation 

strategies and will perform 

corrective action if strategies 

are found not to be working, 

and how verification of the plan 

will take place?

These procedures will be 

identified in the food defense 

plan. 
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 9 of 18

Req. No. Requirement Reference Citation Auditor Guidance Documentation

(c) Food defense verification in accordance 

with § 121.150.

1.4.3.1 The facility must establish and 

implement written procedures 

for the monitoring of mitigation 

strategies. The monitoring 

activities must be documented.

Food defense monitoring.

As appropriate to the nature of the 

mitigation strategy and its role in the 

facility’s food defense system:

(a) Written procedures. You must establish 

and implement written procedures, 

including the frequency with which they are 

to be performed, for food defense 

monitoring of the mitigation strategies.

(b) Food defense monitoring. You must 

monitor the mitigation strategies with 

adequate frequency to provide assurances 

that they are consistently performed. 

(c) Records—(1) Requirement to

document food defense monitoring. You 

must document the monitoring of mitigation 

strategies in accordance with this section in 

records that are subject to verification in 

accordance with § 121.150(a)(1) and 

records review in accordance with § 

21.150(a)(3)(i).

(2) Exception records. Records may be 

affirmative records demonstrating the 

mitigation strategy is functioning as 

intended. Exception records demonstrating 

the mitigation strategy is not functioning as 

intended may be adequate in some 

circumstances.

21 CFR 

121.140

Ask to see the documented 

procedures for the monitoring 

of the food defense mitigation 

actions. These may include 

procedures for inspecting the 

facility on a regular basis to see 

such things as:

- exterior lighting is 

working. 

- exterior doors are 

locked to prevent 

outside access.

- employees are 

appropriately 

restricted to work 

areas. 

- bulk storage 

containers are locked.

These actions may also include 

background checks of new 

employees, the implementation 

of employee identification 

cards/fobs, an alarm system that 

monitors the facility during off 

hours, etc.

Ask to see the associated 

records that document when 

and by whom these actions 

have occurred.

Policy, Record
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 10 of 18

1.4.3.2 If mitigation strategies are not 

properly implemented, the 

facility must establish and 

implement corrective action 

procedures. The corrective 

action must describe the steps to 

be taken to ensure that 

appropriate action is taken to 

correct and prevent identified 

problems. The corrective and 

preventive actions must be 

documented as records.

Food defense corrective actions.

(a) Food defense corrective action

procedures. As appropriate to the nature of 

the actionable process step and the nature of 

the mitigation strategy:

(1) You must establish and implement 

written food defense corrective action 

procedures that must be taken if mitigation 

strategies are not properly implemented.

(2) The food defense corrective action 

procedures must describe the steps to be 

taken to ensure that:

(i) Appropriate action is taken to identify 

and correct a problem that has occurred 

with implementation of a mitigation 

strategy; and

(ii) Appropriate action is taken, when 

necessary, to reduce the likelihood that the 

problem will recur.

(b) Records. All food defensecorrective 

actions taken in accordance with this section 

must be documented in records that are 

subject to food defense verification in 

accordance with § 121.150(a)(2) and 

records review in accordance with 

§ 121.150(a)(3)(i).

21 CFR 

121.145

Verify that a documented 

procedure is establishedfor 

corrective action if the facility 

determines that a mitigation 

procedure has not been 

performed. This could be as a 

result of their monitoring 

activities. Do they maintain 

records of the corrective 

action?

Policy, Record

1.4.3.3 The facility must establish and 

implement written procedures to 

verify that:

- Food defense monitoring is 

being conducted;

- Appropriate decisions about 

food defense corrective 

actions are being made;

- Mitigation strategies are 

properly implemented and 

Food defense verification.

(a) Food defense verification activities. 

Food defense verification activities must 

include, as appropriate to the nature of the 

mitigation strategy and its role in the 

facility’s food defense system:

(1) Verification that food defense 

monitoring is being conducted as required 

by § 121.138 (and in accordance with § 

121.140);

21 CFR 

121.150

Identify if the facility has 

documented procedures to 

make sure their food defense 

mitigation and monitoring 

steps, and the planned 

reanalysis of the plan are being 

performed. These should be 

identified in the food defense 

plan.

Policy, Record
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 11 of 18

are significantly minimizing 

or preventing the significant 

vulnerabilities; and

- Reanalysis of the food 

defense planhas occurred as 

required.

The verification activities must 

include:

- Review of the food defense 

monitoring and food defense 

corrective actions records 

within appropriate 

timeframes; and

- Other activities appropriate 

for verification of proper 

implementation of 

mitigation strategies.

The verification activities must 

be documented as records.

(2) Verification that appropriate decisions 

about food defense corrective actions are 

being made as required by § 121.138 (and 

in accordance with § 121.145);

(3) Verification that mitigation strategies 

are properly implemented and are 

significantly minimizing or preventing the 

significant vulnerabilities. To do so, you 

must conduct activities that include the 

following, as appropriate to the facility, the 

food, and the nature of the mitigation 

strategy and its role in the facility’s food 

defense system:

(i) Review of the food defense monitoring 

and food defense corrective actions records 

within appropriate timeframes to ensure that 

the records are complete, the activities 

reflected in the records occurred in 

accordance with the food defense plan, the 

mitigation strategies are properly 

implemented, and appropriate decisions 

were made about food defense corrective 

actions; and 

(ii) Other activities appropriate for 

verification of proper implementation of 

mitigation strategies; and 

(4) Verification of reanalysis in accordance 

with § 121.157.

(b) Written procedures. You must establish 

and implement written procedures, 

including the frequency for which they are 

to be performed, for verification activities 

conducted according to § 121.150(a)(3)(ii).

(c) Documentation. All verification 

activities conducted in accordance with this 

section must be documented in records.

Document how often the 

review occurs and who is 

responsible for performing the 

review. 

Are there records of this 

review?
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 12 of 18

1.5 Food Defense Plan Reanalysis

Req. No. Requirement Reference Citation Auditor Guidance Documentation

1.5.1 The facility must conduct a 

reanalysis of the food defense 

plan as a whole at least once 

every 3 years.

(a) You must conduct a reanalysis of the 

food defense plan, as a whole at least once 

every 3 years.

21 CFR 

121.157 

(a)

Verify that the facility has a 

plan to reanalyze the food 

defense plan. How often do 

they do this? Is it done at least 

every three years? Who is 

responsible for performing 

this?

Policy

1.5.2 The facility must conduct a 

reanalysis of the food defense 

plan as a whole, or the 

applicable portion of the plan, 

whenever:

- A significant change made 

in the activities conducted 

at your facility creates a 

reasonable potential for a 

new vulnerability or a 

significant increase in a 

previously identified 

vulnerability;

- New information is 

available about potential 

vulnerabilities associated 

with the food operation or 

facility;

- The facility has found that a 

mitigation strategy, a 

combination of mitigation 

strategies, or the food 

defense plan as a whole is 

You must conduct a reanalysis of the food 

defense plan as a whole, or the applicable 

portion of the food defense plan:

(1) Whenever a significant change made in 

the activities conducted at your facility 

creates a reasonable potential for a new 

vulnerability or a significant increase in a 

previously identified

vulnerability;

(2) Whenever you become aware of new 

information about potential vulnerabilities 

associated with the food operation or 

facility;

(3) Whenever you find that a mitigation 

strategy, a combination of mitigation 

strategies, or the food defense plan as a 

whole is not properly implemented; and

(4) Whenever FDA requires reanalysis to 

respond to new vulnerabilities, credible 

threats to the food supply, and 

developments in scientific understanding 

including, as

appropriate, results from the Department of 

Homeland Security biological, chemical, 

(b) Does the facility’s policy for 

reanalysis of the plan identify 

the need to do it when 

something has changed at the 

facility, when the facility 

identifies a need for a change, 

or if required by FDA?

Policy
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 13 of 18

Req. No. Requirement Reference Citation Auditor Guidance Documentation

not properly implemented; 

and

- FDA requires reanalysis to 

respond to new 

vulnerabilities, credible 

threats to the food supply, 

and developments in 

scientific understanding 

including, as appropriate, 

results from the Department 

of Homeland Security 

biological, chemical, 

radiological, or other 

terrorism risk assessment.

radiological, or other terrorism risk 

assessment.

1.5.3 The reanalysis of the food 

defense plan must be completed 

prior to any change in 

activities, within 90 days of the 

start of associated production, 

or later with written 

justification.

You must complete such reanalysis required 

by paragraphs (a) and (b) of this section and 

implement any additional mitigation 

strategies needed to address the significant 

vulnerabilities identified, if any:

(1) Before any change in activities 

(including any change in mitigation 

strategy) at the facility is operative;

(2) When necessary within 90-calendar days 

after production; and 

(3) Within a reasonable timeframe, 

providing a written justification is prepared 

for a timeframe that exceeds 90 days after 

production of the applicable food first 

begins.

(c) Verify that the facility 

understands the need to 

reanalyze the plan before they 

make changes in their facility 

or procedures. The company 

may have a change 

management policy – does it 

include a step to consider the 

food defense implications?

Policy

1.5.4 The facility must revise the 

written food defense plan if a 

significant change in the 

activities conducted at the

facility creates a reasonable 

You must revise the written food defense 

plan if a significant change in the activities 

conducted at your facility creates a 

reasonable potential for a new vulnerability 

or a significant increase in a previously 

(d) Verify that the facility has 

made the appropriate changes 

in their food defense plan if 

they identified the need as part 

of a reanalysis or the 

Policy
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 14 of 18

Req. No. Requirement Reference Citation Auditor Guidance Documentation

potential for a new 

vulnerability or a significant 

increase in a previously 

identified vulnerability or 

document the basis for the 

conclusion that no revisions are 

needed.

identified vulnerability or document the 

basis for the conclusion that no revisions are 

needed.

implementation of a change in 

a process or the facility.
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 15 of 18

1.6 Records

Req. No. Requirement Reference Citation Auditor Guidance Documentation

1.6.1 Food defense records must:

- Be kept as original records, 

true copies, or electronic 

records;

- Contain the actual values 

and observations obtained 

during food defense 

monitoring;

- Be accurate, indelible, and 

legible;

- Be created concurrently 

with performance of the 

activity documented; and

- Be as detailed as necessary 

to provide history of work 

performed.

Records subject to the requirements of this 

subpart.

(a) Except as provided by paragraph (b) of 

this section, all records required by subpart 

C of this part are subject to all requirements 

of this subpart.

(b) The requirements of § 121.310 apply 

only to the written food defense plan.

§ 121.305 General requirements applying to 

records.

Records must:

(a) Be kept as original records, true copies 

(such as photocopies, pictures, scanned 

copies, microfilm, microfiche, or other 

accurate reproductions of the original 

records), or electronic records;

(b) Contain the actual values and 

observations obtained during food defense 

monitoring;

(c) Be accurate, indelible, and legible;

(d) Be created concurrently with 

performance of the activity documented;

(e) Be as detailed as necessary to provide 

history of work performed; and

Subpart D—

Requirements 

Applying to 

Records That 

Must Be 

Established 

and 

Maintained

21 CFR 

121.301

Ask the facility how they 

manage their records 

associated with the food 

defense plan and procedures. 

Make sure that the records are 

available as either a hard copy 

or electronic record.

Record

1.6.2 Records must include:

- Information adequate to 

identify the facility (e.g., the 

name, and when necessary, 

the location of the facility);

(f) Include:

(1) Information adequate to identify the 

facility (e.g., the name, and when necessary, 

the location of the facility);

(2) The date and, when appropriate, the time 

of the activity documented;

(3) The signature or initials of the person 

performing the activity; and

Review a few of the records to 

see if they identify the facility, 

are initialed or signed by the 

person performing the work, 

and if they identify when the 

procedure was done. 

Record
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 16 of 18

- The date and, when 

appropriate, the time of the 

activity documented;

- The signature orinitials of 

the person performing the 

activity; and

- Where appropriate, the 

identity of the product and 

the lot code, if any.

(4) Where appropriate, the identity of the 

product and the lot code, if any.

(g) Records that are established or 

maintained to satisfy the requirements of 

this part and that meet the definition of 

electronic records in § 11.3(b)(6) of this 

chapter are exempt from the

requirements of part 11 of this chapter.

Records that satisfy the requirements of this 

part, but that also are required under other 

applicable statutory provisions or 

regulations, remain subject to part 11 of this 

chapter.

1.6.3 The food defense plan must be 

signed and dated by the owner, 

operator, or agent in charge of 

the facility when it is first 

completed, and when modified.

Additional requirements applying to the 

food defense plan.

The owner, operator, or agent in charge of 

the facility must sign and date the food 

defense plan:

(a) Upon initial completion; and

(b) Upon any modification.

21 CFR 

121.310

Ask to see where the facility 

owner or manager has signed 

and dated the food defense 

plan. Is the date on or after 

the most recent edition of the 

plan? The signature can be an 

actual signature or an 

electronic signature.

Record

1.6.4 Food defense records:

- Must be retained at the 

facility for at least 2 years 

after the date they were 

prepared or after their use is 

discontinued.

- Except for the fooddefense 

plan, offsite storage of 

records is permitted if such 

records can be retrieved and 

provided onsite within 24 

hours of request. The food 

defense plan must remain 

onsite.

Requirements for record retention.

(a)(1) All records required by this part must 

be retained at the facility for at least 2 years 

after the date they were prepared.

(2) Records that a facility relies on during 

the 3-year period preceding the applicable 

calendar year to support its status as exempt 

as a very small business must be retained at 

the facility as long as necessary to support 

the status of a facility as a very small 

business during the applicable calendar 

year.

(b) The food defense plan must be retained 

for at least 2 years after its use is 

discontinued.

21 CFR 

121.315

Ask how long the food 

defense records are 

maintained and where they are 

maintained.

Record
SCI Division Inspection Series Food Defense Audit Standard

Effective Date: June 2022 Page 17 of 18

- If the plant or facility is 

closed for a prolonged 

period, the food defense 

plan may be transferred to 

some other reasonably 

accessible location but must 

be returned to the plant or 

facility upon request.

(c) Except for the food defense plan, offsite 

storage of records is permitted if such 

records can be retrieved and provided onsite 

within 24 hours of request for official 

review. The food defense plan must remain 

onsite.

Electronic records are considered to be 

onsite if they are accessible from an onsite 

location.

(d) If the facility is closed for a prolonged 

period, the food defense plan may be 

transferred to some other reasonably 

accessible location but must be returned to 

the facility within 24 hours for official 

review upon request.
SCI Division Inspection Series GMP Audit Standard

Effective Date: June 2022 Page 18 of 18

REFERENCE LINKS Version Date

(Printed for distribution)

Insert Link Title: PSA Auditor Manual (in development) __________

Insert full website address

Insert Link Title: GMP Audit Standard __________

https://www.ams.usda.gov/sites/default/files/media/GMPAuditStandard.pdf

Insert Link Title: Food Defense Audit Checklist __________

Insert full website address (in development)

Insert Link Title: SCI Auditor Manual (in development) __________

Insert full website address

Checked Materials have been printed from the links in this manual and included for 

reference.