Food Defense Audit
Many food and beverage facilities have a food defense plan in place.
The real question is whether it will hold up under today’s more detailed FDA inspection expectations.
A food defense audit provides a structured way to evaluate IA Rule compliance under 21 C.F.R. Part 121, identify gaps in your plan, records, mitigation strategies, and facility controls, and decide what needs to be corrected before inspection.
WHY ORGANIZATIONS TRUST BPS
- 36 years in security consulting
- 150+ years of combined expertise
- Independent and vendor-neutral
- 96% Net Promoter Score
Thank you for your message
We’ll be in touch within 48 hours.
In the meantime, here’s a quick look at our approach.
Do You Need a Food Defense Audit?
The FDA’s Intentional Adulteration Rule, set out in 21 C.F.R. Part 121, requires covered food facilities to develop and implement food defense measures to protect against intentional adulteration intended to cause wide-scale public health harm.
For many facilities, the issue is not whether a food defense plan exists. It is whether the plan is complete, current, implemented, and supported by the controls needed to make it work.
FDA inspection expectations are changing. In the webinar FDA’s Approach to Food Defense Inspections, the agency describes a move away from cursory checks toward more detailed inspections. Facilities are expected to show not just that the plan exists, but that the required records, mitigation strategies, training, and supporting controls are in place.
Responsibility often sits with food safety or quality teams, but the exposure reaches further than one department. FDA inspection readiness, GFSI-aligned audits, customer assurance, operational continuity, brand protection, and regulatory defensibility can all be affected by the same gaps. An independent audit gives those teams a clearer view of what is documented, what is implemented, and where the facility may still be exposed.
A FOOD DEFENSE AUDIT MIGHT BE APPROPRIATE IF:
- Your facility is covered under 21 C.F.R. Part 121
- Your food defense plan has not been reviewed against current FDA inspection expectations
- Your vulnerability assessment and actionable process steps may no longer reflect current operations
- Mitigation strategies, monitoring, or verification processes are inconsistent, incomplete or not properly recorded
- Records, training, or management components are difficult to produce during inspection
- Facility controls are not clearly connected to the actionable process steps in your plan
BPS helps identify where the written program, physical environment, and day-to-day operations might not yet align.
What Does a Food Defense Audit Review?
Vulnerability assessment
Significant vulnerabilities and actionable process steps need to be properly identified, assessed, and documented. An actionable process step is a point, step, or procedure in the facility’s operation where a significant vulnerability requires mitigation.
Mitigation strategies
Mitigation strategies should be tied to specific actionable process steps and designed to minimize or prevent the identified vulnerability.
Records and training
Records need to be complete, accessible, and accurate. Training should match the responsibilities assigned to personnel. Qualified Individuals are personnel qualified by education, training, or experience to perform specific food defense roles.
Food defense plan
The written food defense plan should contain the required elements and reflect day-to-day facility operations.
Management components
Monitoring, corrective action, verification, and reanalysis procedures need to be clear, documented, and applied consistently. The audit also looks at whether duties are properly separated. If the same person implements and monitors a mitigation strategy, the facility may lose the independent check needed to identify deviations or insider risk.
Facility controls
Facility controls need to support the food defense plan in practice. That includes reviewing whether access, visitor movement, restricted areas, contractor activity, and security systems support the plan.
Where Standard Audits Can Leave Gaps
Food safety and food defense are both essential, but they address different risks.
Food safety focuses on accidental contamination, whereas food defense focuses on intentional adulteration, including malicious acts intended to cause wide-scale public health harm.
That distinction matters. A facility may have strong quality and HACCP systems and still have vulnerabilities related to malicious intent, insider access, contractor movement, visitor controls, physical access to actionable process steps, or whether security systems support the plan in real conditions.
Third-party audits can leave similar gaps. Strong performance on GFSI-aligned audits such as SQF, BRCGS, or AIB does not always mean a facility is ready for detailed FDA review under the IA Rule. In our audit work, we often see gaps in areas those audits do not examine in the same depth, including vulnerability assessments, records, training, and management controls.
A BPS audit is designed to identify the gaps that can sit between:
- What the plan says
- What people have been trained to do
- What records show
- What facility controls actually allow
- What an intentional act would actually encounter
Where Food Defense Intersects with Facility Controls
A food defense program depends on whether the facility’s access, restricted areas, contractor and visitor movement, and security systems work the way the plan assumes.
BPS reviews the facility controls that may support or weaken a food defense program, including:
- Video surveillance
- Food defense restricted areas
- Electronic access control
- Key control
- Visitor management
- Mechanical door integrity
- Guard operations
- Alarm systems
- Maintenance & testing of security systems
- Penetration testing programs
- Contractor management
- Truck driver management
These controls need to support the plan in practice: limiting unauthorized access, helping staff detect abnormal activity, and giving the facility a practical basis for assessment and response.
BPS reviews whether those controls perform the role the plan assigns to them.
What BPS Provides
BPS provides independent food defense audit support for food and beverage facilities preparing for FDA inspections, customer scrutiny, internal review, or program improvement.
BPS does not sell security equipment or represent manufacturers. That independence is important in food defense, where the answer is rarely one control or one vendor.
Recommendations need to reflect the regulation, the facility, the operating environment, and the way people move through the site.
A typical engagement may include:
- Review of the existing food defense plan
- Evaluation of the vulnerability assessment and actionable process steps
- Assessment of mitigation strategies
- Examination of monitoring, corrective actions, verification, and reanalysis
- An executive summary to support leadership discussion and planning
- Review of records and training documentation
- Site review of facility access points, operational controls, and conditions that support the food defense plan
- Identification of compliance gaps and practical weaknesses
- Prioritized findings and recommendations
Food Defense Audit & Compliance Expertise
BPS brings food defense, physical security, and compliance experience into one review.
This work is supported by credentials held within the BPS team, including active FSPCA Food Defense certification, FPDI food defense training, and AIB Certified Food Defense Coordinator credentials.
That matters because the audit has to look at both the documentation and the facility conditions behind it.
Common Food Defense Audit Findings
Across more than 125 food defense audits, BPS has identified recurring compliance gaps in food and beverage facilities.
- Vulnerability assessment gaps (§ 121.130)
Facilities might not identify significant vulnerabilities or actionable process steps with enough operational detail. - Food defense plan gaps (§ 121.126)
Existing plans might be incomplete, outdated, or difficult to manage as facility conditions change. - Management control issues (§ 121.138)
Monitoring, corrective action, verification, and reanalysis procedures might not be clearly assigned, properly separated, or consistently applied. - Records and training issues (§ 121.301 and § 121.4)
Understanding how your facility operates and what matters most - Facility control gaps
Restricted areas, access controls, visitor movement, contractor activity, and security systems might not fully support the food defense plan.
Our white paper goes deeper into these findings, with practical examples and recommendations drawn from BPS audit work.
Food Defense Testimonials
Big part of developing our Food Defense plansYou and your team did a great job helping us identify potential gaps in our security programs and were a big part of developing our Food Defense plans, as well as linking them together.
SVP. Technical Services & Corporate Quality
Saving us needless expenseBPS’s knowledge of regulations and the food industry allowed us to exclude process steps that were not legitimate risks, thus saving us needless expense.
Manager ANSC Security, Abbott Laboratories
FAQs
Common questions about Food Defense Audits.
Prepare before the inspection finds the gap
Get clarity on your food defense program before your next inspection or audit.
BPS can help you evaluate whether your plan, records, and facility controls are aligned with current FDA expectations.
