Food Defense and Employees FIRST

Every other contamination topic assumes nobody meant it. Bacteria multiply because a cooler drifted warm. Allergen protein crosses because a grill was not cleaned. Food defense is the one topic that assumes somebody did mean it.

What is food defense?

Food defense is the effort to protect food from deliberate contamination or tampering by people who intend to cause harm. It sits alongside food safety rather than inside it: food safety controls accidents, food defense controls intent.

The 2022 Food Code Supplement added a formal definition of food defense, and it did something with more day-to-day consequence than a definition. It made employee awareness of food defense a requirement. A manager is now expected to make sure staff can recognize signs of deliberate contamination in the work they actually do, and to know that reporting suspicious activity is part of the job.

Where the threat comes from

Deliberate contamination is not mainly a terrorism scenario. The realistic sources are closer to the back door.

The contaminant can be biological, chemical, or physical, the same three categories as accidental contamination, and in the most serious cases radioactive. An attack can be launched anywhere along the supply chain, but it usually targets one item, one process, or one business.

The practical defense is friction. The harder it is for anyone to reach food unobserved, the less attractive the operation is as a target. A food defense program should concentrate on the specific points where food sits accessible and unwatched.

Employees FIRST

The FDA's Employees FIRST initiative is the current framework, and it stands for Follow, Inspect, Recognize, Secure, Tell. It is deliberately simple, because it is aimed at food handlers rather than at managers: five actions, one per letter, tied to what a food handler can see from where they already stand.

Read down the column and the logic is plain: know the plan, look around you, notice what is wrong, lock down what is yours, and speak up. Everything else in a food defense program is management's job. These five are the food handler's.

Learn it by the five verbs rather than the five letters. Scenario questions describe a situation, an unfamiliar person near the walk-in or a case with a broken seal, and ask what the handler should do. The answer maps onto one of the five, and most often onto Tell.

A note for anyone studying from an older book

Editions through the 7th Edition Revised taught food defense with the FDA's earlier five-letter tool, spelled A-L-E-R-T, which stood for Assure, Look, Employees, Reports, Threat. That tool was aimed at management-level program design. ServSafe has since moved to Employees FIRST, which is aimed at employee awareness, in response to the Supplement's employee awareness requirement.

A great many secondhand books, printable cram sheets, and free online guides still teach the older five letters. If a question asks for the FDA tool used to raise employee awareness of food defense, the answer is Employees FIRST. Do not let a memorized acronym from an out-of-date book cost you a question.

Signs of deliberate contamination

• Broken, missing, or tampered seals on containers and packaging
• Unusual appearance, odor, or color in food or in an ingredient
• Evidence that someone has been in a restricted area
• Missing or displaced locks, or security cameras that have been moved
• Unfamiliar people in food storage or prep areas, or someone in the building without a reason to be there
• Deliveries that arrive unscheduled, or from an unfamiliar driver or vehicle

What to do if tampering is suspected

1. Do not use or serve the suspected food.
2. Secure the area and the food so nothing else is disturbed and nobody else handles it.
3. Contact your manager, and have the manager contact the local regulatory authority.
4. Contact law enforcement where the situation warrants it.
5. Document everything: what was seen, when, where, and by whom.

The order matters. Isolating the product and the scene comes before any attempt to work out what happened.

Where food defense fits in the operation

Food defense is a management program with a food handler awareness layer on top. The manager's side includes controlling access to the building and to storage, supervising the receiving door so deliveries are never left unattended, verifying that deliveries were scheduled and come from approved suppliers, restricting who can enter prep and storage areas, keeping chemical stores locked, and maintaining a written food defense plan that staff are trained on.

It connects directly to two other topics. Approved suppliers are the supply chain end of the same problem. Crisis management is what happens after: an operation facing suspected tampering is in the same procedural territory as one facing an imminent health hazard, and both may require closing, notifying the regulatory authority, and discarding affected food.

Food Handler versus Manager: how deep to go

Food Handler candidates need the definition of food defense, the five letters of Employees FIRST and the verb behind each, the signs of tampering, and the five steps when tampering is suspected. The Food Handler exam is 40 questions and passes at 75%, or 30 correct, so a single acronym question is worth taking seriously.

Manager candidates need all of that plus the sources of threat, the employee awareness requirement introduced by the Supplement, the design of a written food defense plan, access control and receiving supervision, and the link to approved suppliers and to crisis management. Manager scenarios usually ask what the manager does after a handler reports something, rather than what the handler should have done.

Practice set

1. What is food defense? A. Protecting food from accidental contamination B. Protecting food from deliberate contamination or tampering C. Defending an operation against an inspection finding D. Preventing allergen cross-contact

2. What does Employees FIRST stand for? A. Follow, Inspect, Recognize, Secure, Tell B. Find, Isolate, Report, Secure, Train C. Follow, Identify, Restrict, Store, Test D. Feel, Inspect, Record, Sanitize, Track

3. A food handler notices a case of produce with a broken seal and a torn liner. What should they do? A. Discard the top layer and use the rest B. Wash the produce thoroughly C. Tell the manager and leave the case alone D. Return it to the delivery driver next week

4. Which is the most common realistic source of deliberate contamination in a foodservice operation? A. Terrorist organizations B. Current or former staff C. Guests in the dining room D. Regulatory inspectors

5. Which letter of Employees FIRST covers locking down ingredients and finished product? A. F B. I C. S D. T

6. A food handler sees an unfamiliar person walking out of the dry storage room. What does Employees FIRST direct them to do? A. Confront the person B. Ignore it, security is not their job C. Tell management D. Check the storage room inventory before saying anything

7. What is the first step when tampering is suspected? A. Taste the food to check it B. Do not use or serve the food, and secure it C. Call the media D. Throw the food in the dumpster immediately

8. Which is a sign of possible deliberate contamination? A. A delivery arriving at the scheduled time B. A container with a broken seal C. A cooler holding at 39F D. A dated label on a ready-to-eat item

9. Whose responsibility is food defense awareness under the current Food Code Supplement? A. Only the owner's B. Only the regulatory authority's C. Management must ensure employees are aware of it D. Nobody's, it is voluntary

10. A food handler follows the operation's written food defense procedures during a delivery. Which letter of Employees FIRST is that? A. F B. R C. S D. T

Answers

1. B. Food defense assumes intent. A is food safety. C is compliance. D is allergen control, a different hazard entirely.

2. A. Follow, Inspect, Recognize, Secure, Tell. B, C, and D are plausible-sounding inventions, which is exactly how this question is usually built.

3. C. A broken seal is a tampering sign: do not use the product, secure it, and tell the manager. A and B both put suspect product into service, and washing does nothing to a chemical contaminant. D delays reporting.

4. B. Current or former staff, usually acting on a grievance, are the most common source in practice. A is the dramatic case rather than the typical one. C and D are not recognized threat categories here.

5. C. Secure. A is following the plan, B is inspecting the work area, D is telling management.

6. C. Tell. A puts the handler at risk and is not what the framework directs. B contradicts the awareness requirement. D delays a report that management needs immediately.

7. B. Do not use or serve it, and secure the food and the area. A is dangerous. C bypasses the manager and the regulatory authority. D destroys evidence that law enforcement or the regulator may need.

8. B. A broken seal on a container. A, C, and D all describe normal, compliant operation.

9. C. The Supplement made employee awareness a management responsibility. A narrows it wrongly. B confuses enforcement with the operation's duty. D is the pre-Supplement position and is now wrong.

10. A. Follow, the first letter, is following the food defense plan and its procedures. B is recognizing something out of the ordinary, C is securing product, D is reporting.

This hub is study material for candidates preparing for ServSafe certification exams. It is not affiliated with, endorsed by, or connected to the National Restaurant Association Educational Foundation, and it does not certify anyone. Certification is issued only by the exam provider.