FSMA Intentional Adulteration FRIA

DEPARTMENT OF HEALTH AND HUMAN SERVICES
Food and Drug Administration

Mitigation Strategies to Protect Food
Against Intentional Adulteration

Docket No. FDA-2013-N-1425

Regulatory Impact Analysis
Regulatory Flexibility Analysis
Unfunded Mandates Reform Act Analysis

Economics Staff
Office of Regulatory Policy and Social Sciences
Center for Food Safety and Applied Nutrition

Executive Summary
This rule requires human food facilities that are required to register and that are part of businesses with
more than $10 million in annual sales, to create a food defense plan, identify actionable process steps,
implement mitigation strategies and related food defense monitoring, corrective actions, and verification
activities to protect these steps, train designated employees, and document these actions. We estimate
the annualized costs of these measures to food producers to be between $280 and $490 million
(annualized over 10 years, at a seven percent discount rate). We were unable to estimate the costs to
FDA of enforcing the rule. The benefits of the actions required by the rule are a reduction in the
possibility of illness and death resulting from intentional adulteration of food. We are unable to
monetize these benefits; however, for attacks that are similar in impact to acts of intentional adulteration
that have happened in the U.S. in the past, the breakeven threshold, counting only producer costs, is 28
to 48 attacks prevented every year. For attacks causing similar casualties as major historical outbreaks of
food-related illness, the breakeven threshold is one or two attacks prevented every year. For catastrophic
terrorist attacks causing thousands of fatalities, the breakeven threshold is one attack prevented every
270 to 470 years.

2

Contents
Executive Summary ........................................................................................................................ 2
A. Introduction ................................................................................................................................ 4
B. Summary of Costs and Benefits ................................................................................................. 5
Table 1.—Annualized Cost and Benefit Overview ................................................ 6
C. Need for Regulation ................................................................................................................... 7
D. Description of FDA Action ........................................................................................................ 7
E. Comments on the Preliminary Regulatory Impact Analysis and our Responses ..................... 11
F. Costs and Benefits of the Rule: Detailed Analysis ................................................................... 17
1. Costs of the Rule ........................................................................................................... 17
a. Learning About the Rule ................................................................................... 18
b. Developing a Food Defense Plan ...................................................................... 19
c. Mitigation Strategies ......................................................................................... 21
Table 2.—Mitigation Strategies with Cost Estimates ........................................... 22
Table 3.—Costs of Mitigation .............................................................................. 25
d. Food Defense Monitoring, Corrective Action, and Verification ...................... 25
e. Training ............................................................................................................. 27
f. Annual Documentation ...................................................................................... 28
g. Costs to Foreign Firms ...................................................................................... 28
h. Costs to FDA..................................................................................................... 29
i. Total Costs ......................................................................................................... 29
Table 4.—Annual, Initial, and Annualized Costs ................................................. 31
2. Benefits of the Rule ...................................................................................................... 32
a. General Model ................................................................................................... 32
b. Scenario 1 Attacks ............................................................................................ 34
c. Scenario 2 Attacks............................................................................................. 34
d. Scenario 3 Attacks ............................................................................................ 35
3. Analysis of Uncertainty ................................................................................................ 37
Table 5.—Low, Mean, and High Total Cost Estimates and Breakeven Numbers 37
Table 6.—Annual, Initial, and Annualized Costs, 5th Percentile .......................... 38
Table 7.— Annual, Initial, and Annualized Costs, 95th Percentile ....................... 39
G. Analysis of Regulatory Alternatives ........................................................................................ 40
1. No Action ...................................................................................................................... 40
2. The Rule ........................................................................................................................ 40
3. The Rule with Dairy Farm Requirements ..................................................................... 40
Table 8.—Dairy Farm Rule Costs by Coverage ................................................... 42
4. A Different Very Small Business Size Threshold than the Rule’s $10 Million ........... 43
Table 9.—Other Facility Exemptions ................................................................... 43
5. Prescribing a Simpler and Less Flexible Rule .............................................................. 43
Regulatory Flexibility Analysis .................................................................................................... 45
1. Number of Small Entities Affected............................................................................... 45
2. Costs to Small Entities .................................................................................................. 45
3. Regulatory Flexibility Options ..................................................................................... 46
4. Description of Recordkeeping and Recording Requirements. ...................................... 46
Unfunded Mandates ...................................................................................................................... 47
Small Business Regulatory Enforcement Fairness Act ................................................................ 48
References ..................................................................................................................................... 49
3

A. Introduction
The Food and Drug Administration (FDA or we) has examined the impacts of the final rule
under Executive Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5 U.S.C. 601612), and the Unfunded Mandates Reform Act of 1995 (Public Law 104-4). Executive Orders 12866 and
13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, when
regulation is necessary, to select regulatory approaches that maximize net benefits (including potential
economic, environmental, public health and safety, and other advantages; distributive impacts; and
equity). We have developed a comprehensive Economic Analysis of Impacts that assesses the impacts of
the final rule. We believe that this final rule is a significant regulatory action under Executive Order
12866.
The Regulatory Flexibility Act requires us to analyze regulatory options that would minimize
any significant impact of a rule on small entities. The annualized costs per entity due to this rule are
about $13,000 for a one-facility firm with 100 employees, and there are about 4,100 small businesses
affected by the rule, so we tentatively conclude that the final rule could have a significant economic
impact on a substantial number of small entities.
The Unfunded Mandates Reform Act of 1995 (section 202(a)) requires us to prepare a written
statement, which includes an assessment of anticipated costs and benefits, before proposing "any rule
that includes any Federal mandate that may result in the expenditure by State, local, and tribal
governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for
inflation) in any one year." The current threshold after adjustment for inflation is $144 million, using the
most current (2014) Implicit Price Deflator for the Gross Domestic Product. This final rule may result in
a 1-year expenditure that would meet or exceed this amount.

4

B. Summary of Costs and Benefits
The total cost of the rule to food producers, annualized over 10 years at a 7 percent discount rate,
is between $280 and $490 million. 1 The first-year cost is between $680 and $930 million. Counting only
domestic firms, the total annualized costs are between $90 and $150 million, with initial costs of
between $220 and $300 million. The average annualized cost per covered facility is between $9,000 and
$16,000, and the average annualized cost per covered firm is between $27,000 and $47,000. We were
unable to estimate the costs to FDA of enforcing the rule, because decisions about the structure and
details of the enforcement system have not yet been made.
The benefits of the actions required by the rule are a reduction in the possibility of illness and
death resulting from intentional adulteration of food. We monetize the damage that various intentional
adulteration scenarios might cause, and present a breakeven analysis showing the number of prevented
attacks at which the benefits are larger than the costs. For attacks that are similar in nature to acts of
intentional adulteration that have happened in the U.S. in the past, the breakeven is 28 to 48 attacks per
year. For attacks causing similar casualties as major historical outbreaks of food-related illness, the
breakeven prevention amount is one or two attacks every year. For catastrophic terrorist attacks causing
thousands of fatalities, the breakeven is one attack prevented every 270 to 470 years, or a 0.21% to
0.37% annual chance of stopping an attack. These breakeven estimates only include producer costs.
When adding FDA enforcement costs, the rule must prevent attacks more often to break even.

1

With a 3 percent discount rate, the annualized cost is between $270 and $480 million. All numbers used in the text
are for a 7 percent rate unless otherwise noted.

5

Table 1 shows the approximate, rounded, mean values for various cost components of the rule:
Table 1.—Annualized Cost and Benefit Overview
All Numbers are USD 2014 (Millions),
Annualized over 10 years
Costs
Learning about Rule
Creating Food Defense Plans
Mitigation Costs
Monitoring, Corrective Action, Verification
Employee Training
Documentation
Subtotal (Domestic Producer Cost)
Cost to Foreign Firms
Cost to FDA
Total
Benefits Lower Chance of Intentional Adulteration

2

3%
7%
Discount Discount
$
3
$
4
$
10
$
11
$
26
$
28
$
62
$
62
$
5
$
6
$
9
$
9
$ 115
$ 119
$ 247
$ 256
Unknown Unknown
$ 362 2 $ 3752
Unquantified

This total does not include costs to FDA of enforcing the rule.

6

C. Need for Regulation
This regulation is mandated by statute. Sections 103, 105, and 106 of the FDA Food Safety
Modernization Act of 2011 (FSMA) direct the Secretary of Health and Human Services to promulgate
regulations to protect against the intentional adulteration of food (Ref. (1)).
The people responsible for managing food production firms make many decisions about what
risks to invest in reducing. When doing so, they take into account the probability of the negative event,
and the damage the event would cause to their firm. If the probability multiplied by the damage is equal
to or greater than the cost of prevention, then they will invest in prevention.
For many negative events, all or most of the damage will be considered. For example, a small
adulteration incident that will likely be traced to the company may be expected to cause damage to the
company’s reputation and sales equal to or greater than the health damage that the adulteration inflicts
on society. In this case, the managers will therefore invest the socially optimal amount in preventing
adulteration.
However, the maximum damage that a major adulteration event can cause to the owners of the
targeted company is the value of the company or the owners’ wealth. The social damage that a
catastrophic terrorist attack causes is therefore larger than the private damage done to people who could
have invested to stop it.
If an attack could cause more damage than the value of the company, then its probability
multiplied by the value of the company may be less than the cost of prevention, while its probability
multiplied by the total social damage is greater than the cost of prevention. In this case, it is not rational
for profit-maximizing managers to invest in prevention, but it is socially optimal. This rule is intended to
address these situations.
D. Description of FDA Action
FDA is requiring domestic and foreign human food facilities to address hazards that may be
introduced with the intention to cause wide scale public health harm. These food facilities are required
to conduct a vulnerability assessment to identify significant vulnerabilities and actionable process steps
and implement mitigation strategies to significantly minimize or prevent significant vulnerabilities
identified at actionable process steps in a food operation. FDA is promulgating these requirements as

7

part of our implementation of FSMA. We expect the rule will help to protect food from intentional
adulteration when the intent of the adulteration is to cause wide scale public health harm.
The rule applies to both domestic and foreign facilities that are required to register under section
415 of the Federal Food, Drug, and Cosmetic Act. However, as explained in the preamble, the rule
contains several exemptions:
•

The rule does not apply to a very small business (i.e., a business, including any
subsidiaries or affiliates, averaging less than $10,000,000, adjusted for inflation, per year,
during the 3-year period preceding the applicable calendar year in both sales of human
food plus the market value of human food manufactured, processed, packed, or held
without sale, e.g., held for a fee), except that the facility must, upon request, provide for
official review documentation sufficient to show that the facility meets this exemption.

•

The rule does not apply to the holding of food, except the holding of food in liquid
storage tanks.

•

The rule does not apply to the packing, re-packing, labeling, or re-labeling of food where
the container that directly contacts the food remains intact.

•

The rule does not apply to activities of a farm that are subject to section 419 of the
Federal Food, Drug, and Cosmetic Act (Standards for Produce Safety).

•

The rule does not apply with respect to alcoholic beverages at a facility that meets certain
conditions.

•

The rule does not apply to the manufacturing, processing, packing or holding of food for
animals other than man.

•

This rule does not apply to on-farm manufacturing, processing, packing, or holding of the
certain foods identified as having low-risk production practices.

The rule establishes various food defense measures that an owner, operator, or agent in charge of
a facility is required to implement to protect against the intentional adulteration of food. Specifically:
•

Prepare and implement a written food defense plan that includes a vulnerability
assessment to identify significant vulnerabilities and actionable process steps, mitigation
strategies and explanations, and procedures for food defense monitoring, corrective
actions, and verification.

8

•

Identify any significant vulnerabilities and actionable process steps by conducting a
vulnerability assessment for each type of food manufactured, processed, packed, or held
at the facility using appropriate methods to evaluate each point, step, or procedure in a
food operation.

•

Identify and implement mitigation strategies at each actionable process step to provide
assurances that the significant vulnerability at each step will be significantly minimized
or prevented and the food manufactured, processed, packed, or held by the facility will
not be adulterated. For each mitigation strategy or combination of strategies implemented
at each actionable process step, facilities must include a written explanation of how the
mitigation strategy(ies) sufficiently minimizes or prevents the significant vulnerability
associated with the actionable process step.

•

Establish and implement mitigation strategies management components, as appropriate to
ensure the proper implementation of the mitigation strategies, taking into account the
nature of the mitigation strategy and its role in the facility’s food defense system.

•

Establish and implement food defense monitoring procedures, including the frequency
with which they are to be performed, for monitoring the mitigation strategies, as
appropriate to the nature of the mitigation strategy and its role in the facility’s food
defense system.

•

Establish and implement food defense corrective action procedures that must be taken if
mitigation strategies are not properly implemented, as appropriate to the nature of the
actionable process step and the nature of the mitigation strategy.

•

Establish and implement food defense verification activities, as appropriate to the nature
of the mitigation strategy and its role in the facility’s food defense system, to include
verification that monitoring is being conducted and appropriate decisions about corrective
actions are being made; verification of proper implementation of mitigation strategies and
verification of reanalysis.

•

Conduct a reanalysis of the food defense plan.

•

Ensure certain qualifications of individuals who perform activities under this final rule.

•

Establish and maintain certain records, including the written food defense plan; written
vulnerability assessment to identify significant vulnerabilities and actionable process
steps; written mitigation strategies; written procedures for food defense monitoring,
corrective actions, and verification; and documentation related to training of personnel.
9

All records are subject to certain general recordkeeping, record retention, and public
disclosure requirements.

10

E. Comments on the Preliminary Regulatory Impact Analysis and our Responses
Comment 1) Some comments state that the rule mandates economic and time costs to private
businesses that are out of proportion to the benefits of the rule.
Response 1) FDA recognizes that the cost of this rulemaking is not inconsequential. However,
the requirements mitigate costs by focusing on only the points, steps, or procedures that are most
vulnerable.
Comment 2) Some comments state that the proposed requirements should not be adopted as a
final rule so long as FDA is unable to quantify the benefits of this approach and show that they are
higher than other possible approaches.
Response 2) This rule is required by statute. We proposed requirements that are based on more
than 10 years of collaboration with industry and reflect some industry best practices to be the most
effective at protecting the food supply. For details, see the Intentional Adulteration Proposed Rule
Federal Register Page 78021 under “B. Interagency Approach to Food Defense”, and Page 78023 under
“Outreach”. We acknowledge that intentional adulteration, where the intent is to cause wide scale public
health harm, is a low probability, but potentially very high consequence, event. We also acknowledge
that we are somewhat limited due to the lack of real world data related to food defense events associated
with wide scale public health harm, and the associated difficulty in making a quantitative comparison of
different alternatives. The benefits of any possible approach to the prevention of intentional adulteration,
including the proposed requirements and many other possible requirements, are uncertain and cannot be
explicitly quantified with real world data related to food defense events associated with wide scale
public health harm.
Comment 3) Some comments state that FDA should consider potential costs to the dairy industry
and the state agencies that oversee them.
Response 3) This final rule imposes no requirements on dairy farms. For our plans regarding
dairy farms, see the preamble of the final rule.
Comment 4) Some comments state that FDA should consider the costs and benefits of addressing
economically motivated adulteration, or food fraud.

11

Response 4) Provisions for preventing economically motivated adulteration of human food are in
the Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for
Human Food regulation, and their costs and benefits are detailed in the Regulatory Impact Analysis for
that regulation.
Comment 5) Several comments state that some mitigation strategies may be more costly for
some facilities than our estimates indicated.
Response 5) Our presented cost estimates are averages across the spectrum of facilities covered
by this rule. We acknowledge that implementing this rule may be more costly at some facilities. In
particular, we expect that the costs for the largest food facilities with the most actionable process steps
could be higher than the estimated average costs, even if they already have a food defense program,
simply because they have so many more actionable process steps than smaller producers. The average
cost estimates include the thousands of smaller food producers also covered by the rule, as shown in the
‘Costs of the Rule’ section of the RIA.
Comment 6) Some comments state that FDA failed to account for the cost of implementing
several costly focused mitigation strategies when calculating industry’s anticipated costs to implement
this rule. Instead, FDA calculated the initial and recurring costs incurred by industry using relatively
inexpensive mitigation strategies.
Response 6) The rule is written to allow facilities the flexibility to implement whichever set of
mitigation strategies is most appropriate to their facility. Producers do not need to use all strategies; they
can choose which mitigation strategies to employ at their facilities. We expect that facilities will
implement the most cost effective mitigation strategies that address their significant vulnerabilities, and
not implement strategies that would be prohibitively expensive when others would suffice.
Comment 7) Some comments state that FDA incorrectly asserts that there will be no additional
costs for food facilities that are already implementing the food defense measures contained in existing
FDA guidances.
Response 7) We apologize for the lack of clarity. The statement was meant to refer only to the
mitigation costs. We know that many facilities are already implementing several mitigation strategies
that satisfy the mitigation strategy requirement of the rule. When we calculate the average cost per
covered facility of implementing mitigation strategies, we account for the percentage of facilities that
12

already have such strategies. However, as shown in the RIA, all of our estimates for learning about the
rule, conducting vulnerability assessments, training, monitoring and corrective action, verification, and
documentation assume that all covered facilities will bear these additional costs.
Comment 8) Some comments state that an alternate approach of loosely protecting the entire
facility rather than focusing on the most vulnerable production steps would minimize implementation
costs for industry, because many leading companies have already implemented the measures that would
be required by this alternate approach.
Response 8) We agree that different approaches may have lower costs for a subset of the
industry; however, an approach that loosely protects the entire facility would not significantly minimize,
or prevent, intentional adulteration of food at the points, steps, or procedures at highest risk of
intentional adulteration because it would not address the highest risk scenario in which an attacker has
legitimate access to a facility (see discussion in section V.C. of the rule). We have a duty to provide
adequate protection for the public while minimizing overall costs of the rule. While our approach may
impose more costs on companies producing more food, we believe it imposes fewer costs on smaller
companies. In particular, we expect that the costs of our approach for the largest food facilities with the
most actionable process steps may be higher than the estimated average costs, even if they already have
a food defense program, simply because they have so many more actionable process steps than smaller
producers. An alternate approach focused on facility protection would impose more equal per-facility
costs on all producers, which would lower the cost for these few hundred large producers while raising it
for the several thousand smaller producers.
Comment 9) One comment asserts that the Institute of Food Technologists / Research Triangle
Institute (RTI) model upon which the PRIA relies heavily was incomplete and did not encompass a
broad segment of the food industry.
Response 9) We agree that the model does not have all the data we would like. However, it is the
best data currently available. It includes a representative sample of food production facilities, chosen to
give data on a wide variety of food production. While it does not include the costs of all possible
mitigation strategies, it does include the costs of a suite of mitigation strategies that we believe would be
sufficient to comply with the mitigation strategy requirements of the rule for most facilities. To the
extent that there are other possible mitigation strategies with no or lower costs compared to the ones in
the model, this will only decrease the average expected costs of the rule, because companies could
13

choose to use those other, possibly cheaper, strategies instead of the ones for which we have estimated
cost.
Comment 10) One comment notes that the PRIA assumes facilities with sales less than $10
million per year will be exempt from the rule’s requirements, and the cost estimates in the PRIA would
not be accurate if a different portion of the food industry is subject to the rule.
Response 10) In Table 6 of the RIA, we include cost estimates for other possible facility
exemptions. However, the final regulation provides an exemption for all facilities with sales less than
$10 million per year. Thus the estimated costs accurately represent the effects of this rulemaking.
Comment 11) One comment states that FDA has produced a standard market failure justification
for the regulation focused on externalities, does not provide evidence that food companies have in fact
underinvested in preventing terrorist attacks, and does not discuss whether or not these externalities are
“inframarginal.”
Response 11) The ‘Need for Regulation’ section of the RIA assumes that managers will
internalize the social costs of many negative events, and invest the socially optimum amount in
preventing them. The regulation focuses on events that cause more damage than the value of the
company. We have observed that larger firms invest substantially more in preventing intentional
adulteration incidents than smaller firms, suggesting that our model is accurate; managers invest more in
prevention as the larger value of their company causes them to internalize more costs. We believe that
these larger investments may be closer to the social optimum, and that our regulation will cause more
companies to make targeted investments in reducing the probability of catastrophic attacks that it would
not be individually rational for them to make. Under current conditions, unpriced risk reduces the social
value of the last (marginal) food product from a company that has underinvested in food defense relative
to its market value, meaning that the externality is not inframarginal and regulation may be justified.
Comment 12) One comment asserts that FDA has failed to show in the PRIA precisely which
industry categories (NAICS or, as the FDA uses, the older SIC codes) will be affected by this rule. The
comment goes on to state that this leaves a number of questions, including what types of foods are
covered, how many facilities are exempted by the $10 million cut-off, and how many firms will not have
actionable process steps.

14

Response 12) The final RIA includes a footnote showing the SIC and NAICS codes used in the
cost calculations. It also includes more information on how many facilities will be covered and
exempted. However, facilities are not covered based on industry category; facilities are required to
comply with the rule if they are required to register with FDA, per section 415 of the FD&C Act, and if
they are not exempted as described in the Exemptions section of the final rule. Some facilities in the
listed codes will not be covered, and some facilities on other codes will be covered, but we believe that
both of these numbers are small.
Comment 13) One comment notes that the Analysis of Uncertainty does not specify the
probability distributions used.
Response 13) The introduction to the Detailed Analysis section describes the probability
distributions used in the analysis.
Comment 14) Some comments state that FDA should use existing estimates for the costs of
conducting vulnerability assessments, including those in different industries, rather than basing costs on
the estimated time.
Response 14) In the PRIA, we requested information on costs of the various requirements in the
proposed rule, including the cost of conducting vulnerability assessments. However, we did not receive
any comments providing such information. To our knowledge, there are no existing studies of the cost of
doing many things required by this regulation, including conducting vulnerability assessments. Different
industries have very different standards for vulnerability assessments; in many cases the processes have
little in common except the name. The best way of calculating all administrative costs of this rule’s
specific requirements is to use the estimated time to do the specific things we require.
Comment 15) One comment notes that, if FDA wants to annualize costs (a practice allowed by
OMB), it ought to also discuss total first-year costs and recurring costs.
Response 15) In Table 4 in the PRIA, we included both initial and annualized costs, and each
section of the cost analysis included a discussion of initial costs. In Table 4 of the final RIA, we use the
same format in reporting of costs.
Comment 16) One comment asks whether the 70 percent average adoption rate for facilities with
100 or more employees for already complying with the mitigation strategies in the Research Triangle
Institute model is an assumption or based on data.
15

Response 16) The referenced documentation for the RTI model includes adoption rate data for
all mitigation strategies in the study. Surveys of food producers show an average of 70 percent adoption
of the relevant food defense strategies.
Comment 17) Some comments state that the Benefits section of the PRIA is based on many
uncertain assumptions.
Response 17) We agree that little data is available regarding benefits, and we were forced to
make assumptions. We are trying to prevent a situation that has never happened before, and it is
impossible to use standard statistical methods on an event that has never been observed. We believe the
assumptions are reasonable. In particular, the assumption that some of the attacks prevented will reduce
likelihood of attacks elsewhere is reasonable because in some cases, the strategies mandated by this rule
will result in the perpetrators being caught in the act, which will result in their incarceration and
subsequent inability to attack other targets.
Comment 18) Some comments state that the Benefits section of the PRIA uses casualty estimates
for a terrorist attack that are unreasonably high in light of past natural outbreaks.
Response 18) The casualty estimate for a Scenario 2 attack is based on past natural outbreaks.
The estimates for a Scenario 3 attack, one designed by a sophisticated attacker to be more deadly than
any natural outbreak, come from peer-reviewed research cited in the PRIA.
Comment 19) Many comments state that the rule imposes a high burden of costs in the form of
producing and maintaining records.
Response 19) The annual documentation costs are between $300 and $1,400 per covered facility,
with an average of about $800.

16

F. Costs and Benefits of the Rule: Detailed Analysis
There is a large degree of uncertainty inherent in this analysis. To reflect this uncertainty, we
define many inputs as probability distributions. In this section, we illustrate the analysis with the mean
value of each probability distribution, rounding in the text for ease of reading but using the unrounded
point estimate in the example calculation to avoid introducing rounding errors. In the Analysis of
Uncertainty, we generate low and high estimates for the total costs with a Monte Carlo simulation that
draws values at random from the probability distributions.
For some parameters, we have a low and high estimate. In these cases, we draw the parameter
from a uniform distribution. The low estimate is the minimum value of the distribution and the high
estimate is the maximum value of the distribution. For other parameters, we have a low estimate, a high
estimate, and a best estimate. In this case, we draw the parameter from a triangular distribution. The low
estimate is the minimum value of the distribution, the best estimate is the peak of the distribution, and
the high estimate is the maximum value of the distribution. The mean of a triangular distribution is the
average of the three estimates used to generate the distribution.
When explaining the calculations, we show example calculations with the 7 percent discount
rate. Both 7 percent and 3 percent discount rates are reported in the summary tables.
1. Costs of the Rule
We estimated the number of firms, facilities, and employees that the rule applies to by using
facility-level data from Dun & Bradstreet’s Global Business Database (Ref. (2)). We used both SIC and
NAICS codes 3 to find facilities that the rule applies to. We counted all human food manufacturers,
including bottled water, nonalcoholic beverage, dietary supplement, and food additive manufacturers.
We did not count farms or retail establishments because they are not required to register. We did not
count warehouses because most will be exempt. Some warehouses, such as those storing food in liquid
storage tanks, may be affected by the rule, and some manufacturers, such as packers and labelers, may
not be affected by the rule because they qualify for the exemption. However, we believe that both of
these numbers are small.

3

SIC codes > = 20000000 and < 22000000; NAICS codes > = 310000 and < 320000

17

To determine the number of facilities covered under this rule, we first matched each facility to its
parent firm. Next we added up the sales for all the facilities in each firm to determine the total sales for
that firm. Firms that have more than $10 million in annual sales are covered under this rule, and the
facilities covered are those that fall under those firms. We found 18,080 firms with less than $10 million
in annual sales and 3,247 firms with more than $10 million in sales. The total costs of learning about the
rule are based on these firm numbers. We found 9,759 food production facilities that are part of firms
with more than $10 million in annual sales and are estimated to be covered by this rule. The total costs
of identifying actionable process steps, implementing mitigation strategies, food defense monitoring,
corrective actions, and verification are based on this number of facilities. We found about 1.2 million
employees that the rule applies to. The total costs of training are based on this employee number.
The facilities that are part of firms with more than $10 million in sales produce 97-98 percent of
the total sales volume of manufactured packaged food, and the very small businesses produce two
percent. The rule therefore covers 98 percent of the food market that is vulnerable to terrorist attack that
could cause massive casualties; two percent of the money that consumers spend on this type of food is
spent on food that is not covered by the regulation (Ref. (2)).
The rule generates several new requirements for food facilities required to register. We calculate
these separately. In some cases, the actions that the rule requires are already being done (Ref. (3)).
a. Learning About the Rule
The 3,200 firms that are fully covered by the rule will spend time to learn about the rule and how
to properly implement it, and to develop a general corporate approach and strategy for complying with
the rule’s requirements. We estimate that this will take one individual at the level of an operations
manager between 20 and 40 hours, or an average of 30 hours, per business. We also estimate that this
will require a legal analyst to spend between 10 and 30 hours, or 20 hours per business.
The mean hourly wage of an operations manager in the food manufacturing industry is $55.59
(Ref. (4)). We double this cost to account for benefits and overhead, making the total cost of time
$111.18. The cost of the operations manager’s time is about $3,300 per firm ($111.18 * 30 = $3,335).
The mean hourly wage of legal analysts in the food industry is $74.99 (Ref. (4)), or $149.98 including
benefits and overhead. The cost of legal time is about $3,000 per business ($149.98 * 20 = $2,999). The
total initial cost per business is about $6,300. We annualize this cost over ten years at a 7 percent
discount rate and calculate average annualized costs of about $900 per business. Because there are about
18

3,200 firms covered by the rule, the total annualized costs to covered firms for learning about the rule
will be about $2.9 million ($902 * 3,247 = $2,928,794).
The 18,000 firms that are exempt from the rule because they have less than $10 million in annual
sales will each incur a burden to learn enough about the rule to verify that they are exempt. This will not
require learning about the entire rule; it will only require learning the exemption criteria and the
documentation requirement for very small businesses. We estimate that this will take one individual at
the level of an operations manager between zero and five hours, or an average of 2.5 hours, per business.
At a time cost of $111.18 per hour for the operations manager, the learning cost per exempt
business is then about $280 ($111.18 * 2.5 = $277.95). We annualize this cost over ten years at a 7
percent discount rate and calculate annualized costs of about $40 per exempt business. Because there are
about 18,000 exempt firms (Ref. (2)), the total annualized costs to these firms for learning about the rule
will be about $720,000 ($39.57 * 18,080 = $715,495).
b. Developing a Food Defense Plan
Developing a food defense plan requires the following actions:
•

Conduct a vulnerability assessment to identify significant vulnerabilities and actionable
process steps.

•

Identify the mitigation strategies to be used at the actionable process steps.

•

Write procedures for food defense monitoring, corrective actions, and verification at the
actionable process steps.

A food defense plan must be developed for each covered facility. We estimate that between 60%
and 90% (average 75%) of facilities will conduct a vulnerability assessment using the Key Activity
Types method described in the preamble of the proposed rule 4, and that the rest will use some other
method after training their managers in that method. Solely for the purposes of this economic analysis,
we assume that operations managers will do all of the work of creating a food defense plan. To the

4

For a description of Key Activity Types and their use to identify actionable process steps, see the Intentional
Adulteration Proposed Rule FR Page 78039-78042.

19

extent that they designate work to other individuals, as the rule allows, the cost of the rule will be lower
than what we estimate here.
For the facilities that use the Key Activity Types method, we estimate that employees will spend
8 to 18 hours, or an average of 13 hours, training in the use of the method and developing the food
defense plan (Ref. (5)). At a time cost of $111.18 per hour for operations managers, the initial cost of
developing a food defense plan for these facilities is then about $1,400 per facility ($111.18 * 13 =
$1,445).
In order to conduct a vulnerability assessment using another method, employees must receive
more extensive training. For those employees who do not choose to utilize the Key Activity Type
guidance to conduct a vulnerability assessment and have little prior knowledge or expertise in
conducting assessments, we estimate that this training will require one or two (average 1.5) employees
per facility to spend three days (24 hours) in training. At a time cost of $111.18 per hour, the training
cost per facility is about $4,000 ($111.18 * 1.5 * 24 = $4,002).
For the facilities that do not use the Key Activity Types method, we estimate that employees will
have to spend 27 to 55 hours, or an average of 41 hours, developing the food defense plan (Ref. (5)). At
a time cost of $111.18 per hour for operations managers, the initial cost of developing a food defense
plan for these facilities is then about $4,600 per facility ($111.18 * 41 = $4,558).
Given our assumption that about 75% of facilities will use the Key Activity Types method of
conducting a vulnerability assessment, the average initial costs per covered facility of creating a food
defense plan are about $3,200 [$1,445 * 75% + ($4,002 + $4,558) * 25% = $3,224]. At a seven percent
discount rate, the annualized costs are about $460 per covered facility.
At a minimum, facilities must conduct a reanalysis of the food defense plans at least once every
three years. We estimate that this required reanalysis will cost 40% of the initial cost of making the plan,
and that it will be done every two to three years (average 2.5), for an average of 16% of the initial cost
per year. Additionally, plans must be reanalyzed whenever there are significant changes at the facility
that may increase vulnerabilities associated with points, steps, or procedures. We estimate that this will
happen at 20% of facilities annually, and will cost 20% of the initial cost when it does happen, for an

20

average of 4% of initial plan costs per facility. Therefore, we estimate an annual cost of 20% (16% +
4%) of the initial cost of making a food defense plan. This annual cost of reanalysis is then about $640
per facility (3,224 * .02 = $644.84) 5.
We add the annualized initial costs to the annual reanalysis costs to calculate total annualized
costs of about $1,100 per facility ($459 + 645 = $1,104). Because there are about 9,759 facilities
covered by the rule (Ref. (2)), the total annualized cost to covered facilities for creating food defense
plans and reanalyzing these plans is about $11 million ($1,104 * 9,759 = $10,772,964).
c. Mitigation Strategies
The rule requires firms to identify and implement mitigation strategies at each actionable process
step to provide assurances that the significant vulnerability at each step will be significantly minimized
or prevented and the food manufactured, processed, packed, or held by such facility will not be
adulterated. 6 The rule does not specify a specific number or set of mitigation strategies to be
implemented. The rule gives operators the flexibility to choose the most appropriate mitigation strategies
for their facility.
For the purposes of cost estimation, we considered the implementation of the eight least
expensive of the following ten mitigation strategies: 7
1. Establish check-in and shipment verification procedures, such as seals and associated
documentation.
2. Restrict movement of delivery drivers once they are in the facility.
3. Secure transfer hoses in locked cabinets.
4. Establish key check-in/check-out procedures.

5

We include the cost of vulnerability assessment training here to account for manager turnover.
For discussion of how the proposed mitigation strategies will reduce the probability of catastrophic food
adulteration events, see the “Proposed § 121.135 – Focused mitigation strategies for actionable process steps” section of the
preamble.
7
The list was generated with input from internal technical experts who have extensive experience conducting
vulnerability assessments and identifying mitigation strategies. While mitigation strategies are facility-specific and are
tailored to address vulnerabilities associated with a facility’s processing environment, we believe the list is a reasonable
approximation of what facilities might do and serves as a representative sampling of mitigation strategies facilities might
employ. The examples provide a range of capital investment and operational changes to illustrate the diversity of potential
mitigation strategies.
6

21

5. Install locks on tanks.
6. Physically inspect cleaned equipment.
7. Prohibit staff from bringing personal items into manufacturing areas.
8. Ensure clear line of sight to actionable process steps (e.g., store stacks of pallets in less
obstructive location).
9. Reduce staging time of ingredients.
10. Retrofit equipment to reduce accessibility (e.g., install lids on open mixers).
We do not require a specific set of mitigation strategies to be applied. Rather, we expect facilities
to identify and implement those mitigation strategies that are necessary and relevant for each actionable
process step in their operation. The mitigation strategies used to estimate costs serve as examples of
mitigation strategies that a facility may identify as suitable for their operation. We expect that the
mitigation strategies a facility employs will be sufficient to significantly minimize or prevent significant
vulnerabilities identified at actionable process steps, but under this rule the determination of which
mitigation strategies to implement rests with the facility.
Some of the covered facilities are already implementing these mitigation strategies (Ref. (3)).
We do not have data on the current adoption rates and costs of these exact mitigation strategies, but we
do have data on the adoption rates and costs of many similar strategies. Where we have data on a similar
strategy, we use the published data, and we estimate new costs where no data exists.
RTI International and the Institute of Food Technologists supplied FDA with data on food
defense practices from industry interviews and a literature review (Ref. (6)). The following table shows
the practices for which they provided cost estimates, and the strategy or strategies on our list that are
equivalent or accomplish the same function:
Table 2.—Mitigation Strategies with Cost Estimates
Strategy with RTI Cost Estimate:
Prohibit after hours key drop deliveries of raw materials
Electronic access controls for employees

Equivalent to: 8
1,2
4,2

8

By “equivalent,” we mean that these strategies serve the same function and provide an equivalent risk reduction.
To the extent that a cheaper strategy can be used, the costs of the rule will be lower than these estimates.

22

Secured storage of finished products
Secured storage of raw materials
Cameras with video recording in storage rooms
Peer monitoring of access to exposed product

3,5,10
3,5,10
8
8

This leaves strategies 6, 7, and 9 without estimates of cost or adoption rates.
RTI used their data to create a prototype food defense cost model. We use this model to estimate
the average cost per facility of implementing all of the mitigation strategies in the table above for
facilities with 100 or more employees that did not currently employ them. When calculating the costs of
each strategy, zero costs are assigned to facilities currently implementing that strategy. The average
adoption rate for these strategies is 70 percent. The model does not take into account potential cost
savings from implementing multiple strategies simultaneously. To the extent that cost savings can be
realized by doing this, the costs of the rule will be lower than our estimate. It is also likely that
companies will not need to implement all of the strategies we considered here for cost estimation
purposes. To the extent that they need to implement fewer strategies, the costs of the rule will be lower
than our estimate.
The costs of these mitigation strategies are a mix of initial capital costs and annual personnel
costs. The costs of prohibiting after-hours key drop deliveries are the labor hours that would likely be
necessary to supervise all raw materials deliveries during the plant’s operating hours. The costs for
electronic access control systems include the initial costs of installing readers on doors in the facility and
setting up the initial cards for each employee in the plant, and annual costs for additional cards (purchase
costs and labor costs to program the cards for each employee). The costs of secured storage of finished
products and raw materials are the costs of installing electronic access controls on the doors to the rooms
with those products. The costs of surveillance cameras with video recording in storage rooms are
primarily the costs of purchasing and installing the cameras. The costs of peer monitoring are the costs

23

of annual training and posting signs with reminders and numbers to call. 9 All initial capital costs are
annualized over ten years. The costs of these strategies, annualized at 7%, are in Table 3.
We estimate that physical inspection of cleaned equipment (Strategy 6) will require first-line
supervisors and other people responsible for quality control to spend about six minutes per inspection,
and that there will be 100 to 300 inspections per year, resulting in a time cost of between 10 and 30
hours per year, per facility, or an average of 20 hours. We estimate that about 70 percent of facilities
already employ this mitigation strategy, so this cost will be borne by 30 percent of facilities. The mean
hourly wage of a first-line supervisor of production and operating workers in the food industry is $25.27
(Ref. (4)), or $50.54 including benefits and overhead. This means that their time costs will be about
$1,000 per year per facility newly implementing the strategy ($50.54 * 20 = $1,010.80). The average
annual cost per covered facility is then about $300 ($1,010.80 * 30% = 303.24).
We estimate that establishing procedures to prohibit staff from bringing personal items into
manufacturing areas (Strategy 7) will require one individual at the level of an operations manager, and
also a legal analyst, between one and three hours, or an average of two hours each, per facility. We
estimate that about 70 percent of facilities already employ this mitigation strategy, so this cost will be
borne by 30 percent of facilities. At a time cost of $111.18 per hour for the operations manager and
$149.98 for the lawyer, the total one-time cost per facility newly implementing this strategy is then
about $520 (2 * $111.18 + 2 * $149.98 = $522.32). The average cost per covered facility is then about
$160 ($522.32 * 30% = $156.70). The costs of enforcing these procedures are included in the ‘Food
Defense Monitoring and Corrective Action’ section below.
Facilities may need to provide secure areas to store personal items that cannot be brought to the
manufacturing area. However, many facilities already provide employee lockers, break rooms, or other
areas where personal items can be kept away from processing areas because it is common practice to
restrict personal items from processing areas due to food safety and sanitation reasons. Alternatively,
facilities could require employees to leave most personal items at home or in employees’ cars. We
believe that there will be no additional costs from these procedures.

9

We believe that producers will only use peer monitoring if there are many people already working who can see
each other, and that they will not hire someone just to watch a few people. If producers have people working alone, they will
use video monitoring instead of peer monitoring.

24

We are unable to estimate the cost of reducing the staging time of ingredients (Strategy 9)
because decisions about the flow of raw materials through a production plant can have a wide variety of
effects on productivity, personnel costs, and production planning. For the purposes of this cost estimate,
we assume that Strategy 9 will be more expensive than the other ones, and therefore will not be chosen.
In some facilities, Strategy 9 may be cheaper, and may be chosen. To the extent that this happens, the
costs of the rule will be lower than our estimates.
Based on experience in working with facilities to implement mitigation strategies (see footnote
4), we believe that it is likely that facilities would employ all but one of the strategies other than
reducing the staging time of ingredients, and that the strategy not employed would be peer monitoring,
the one with the highest average annualized cost. To the extent that fewer mitigation strategies are
necessary to protect the actionable process steps, the costs of the rule will be lower than our estimates.
The total initial cost of implementing mitigation strategies is about $10,000 per covered facility.
The annualized cost of these initial costs is about $1,400 per facility. The annualized recurring costs are
about $1,500 per facility. The total annualized cost is about $2,900 per facility:
Table 3.—Costs of Mitigation
Average cost per covered facility

Initial

Prohibit after hours key drop deliveries of raw materials
Electronic access controls for employees
Secured storage of finished products
Secured storage of raw materials
Cameras with video recording in storage rooms
Peer monitoring of access to exposed product (not used)
Physical inspection of cleaned equipment
Prohibit staff from bringing personal items
Total

$
$
$
$
$
$
$
$
$

Recurring

1,122
1,999
3,571
3,144
47
157
9,993

$ 1,070
$
82
$
$
$
$ 1,122
$ 303
$
$ 1,455

Total
Annualized
$ 1,070
$ 242
$ 285
$ 508
$ 448
$ 1,129
$ 303
$
22
$ 2,878

Because there are about 9,800 facilities that are part of firms that must implement mitigation
strategies (Ref. (2)), the total annualized costs of mitigation strategies in these facilities will be about
$28 million ($2,878 * 9,759 = $28,086,159).
d. Food Defense Monitoring, Corrective Action, and Verification

25

The rule requires that facilities establish and implement procedures for monitoring the mitigation
strategies, and for taking corrective action if mitigation strategies are not properly implemented.
It also requires that facilities verify that food defense monitoring is being conducted, appropriate
decisions about corrective actions are being made; and that the mitigation strategies are properly
implemented and are significantly minimizing or preventing the significant vulnerabilities.
We conducted an expert elicitation to determine the per-facility amount of time required by these
three activities, and what percentage of the activities could be done by production workers and what
percentage must be done by line supervisors (Ref. (5)). We report the average values given by the
experts here, and in the Monte Carlo simulation, we choose one value in each simulation run.
We estimate that monitoring activities will take an average of 114 hours per facility, and that
78% of monitoring hours can be done by production workers, for an average of 88 hours of worker time
and 26 hours of supervisor time.
We estimate that corrective actions will take an average of 22 hours per facility, and that 39% of
corrective action hours can be done by production workers, for an average of 8 hours of worker time and
13 hours of supervisor time.
We estimate that verification activities will take an average of 39 hours per facility, and that 14%
of verification hours can be done by production workers, for an average of 5 hours of worker time and
34 hours of supervisor time.
The total time required of line production workers by these three activities is 102 hours. The
mean hourly wage of a line production worker in the food manufacturing industry is $12.87 (Ref. (4)).
We double this cost to account for benefits and overhead, making the total cost of time $25.74. The
average cost of worker time is then about $2600 per year per facility (102 * $25.74 = $2,625).
The average total time required of first-line supervisors by these three activities is about 73
hours. Given the time cost of $50.54 for first-line supervisors, the average cost of supervisor time is then
about $3,700 per year per facility (73.05 * 50.54 = $3,692).
We add up these labor costs to calculate that the costs for food defense monitoring, corrective
action, and verification will be about $6,300 per year per facility ($2,624 + $3,692 = $ 6,316).

26

Because there are about 9,800 facilities that are part of firms that must implement mitigation
strategies (Ref. (2)), the total annual costs of food defense monitoring, corrective action, and verification
in these facilities will be about $62 million ($6,316 * 9,759 = $61,639,588).
e. Training
Some training required by the rule is generic and some is specialized. The rule requires that
certain personnel be trained in: (1) food defense awareness and (2) their respective responsibilities in
implementing mitigation strategies. FDA has published training courses, which are available online and
can be used to meet the requirement for food defense awareness training. Training employees in their
specific responsibilities in implementing mitigation strategies (relevant to the actionable process step to
which the employee is assigned) is included in the cost estimates for those strategies. The cost of
training associated with development of the food defense plan, choosing and explaining mitigation
strategies, and performing a reanalysis of the plan is included in the cost of learning about the rule. The
cost of training associated with performing or overseeing the performance of a vulnerability assessment
is included in the cost of mitigation strategies and actionable process steps.
All supervisors and employees assigned to actionable process steps in covered facilities must
receive appropriate training in food defense awareness, and this training must be documented. We
estimate that the training and documentation will require between zero and two hours, or an average of
one hour, per employee when the rule takes effect or when a new employee is hired. We also estimate
that between 10 percent and 50 percent, or an average of 30 percent, of all workers and supervisors in
covered facilities are assigned to work at actionable process steps.
The mean hourly wage in the food manufacturing industry is $16.67 (Ref. (4)), or $33.34
including benefits and overhead. This average includes both production workers and supervisors. With
one hour of training per worker, the initial training cost is $33.34 per worker receiving training. We
annualize this cost over ten years at a 7 percent discount rate and calculate average annualized costs of
about $4.75 per employee receiving training. Employee turnover in the food manufacturing industry is
high, so we estimate that turnover is about 33 percent for the covered facilities. With a turnover of 33
percent, annual training costs per job will be about $11 per position requiring training. Adding the
annual training costs to the annualized initial costs yields annual training costs of about $15.75 per job at
an actionable process step ($4.75 + $11.00 = $15.75).

27

There are about 1.2 million employees in firms covered by the rule (Ref. (2)), so the total
annualized costs of the training required by the rule will be about $5.8 million ($15.75 * 1,224,011 *
30% = $5,783,109).
f. Annual Documentation
The facilities covered by the rule will also incur annual costs to document compliance with the
food defense plan. These costs are in addition to the per-employee costs of documenting that employee’s
training, calculated in the previous section. We estimate that the overall documentation would, without
any existing records that can be used, take one individual at the level of an operations manager, and also
a legal analyst, between zero and ten hours, or an average of five hours each per facility. However,
facilities may use existing documentation to satisfy the requirements of this rule. Many mitigation
strategies are already used by 70% of facilities, and we estimate that about 50% of facilities using these
strategies will already be producing documentation that will satisfy the requirements of this rule. So, on
average, 35% of the documentation is already completed, and this rule will require an average of 3.25
hours each per facility.
At a time cost of $111.18 per hour for the operations manager and $149.98 per hour for the legal
analyst, the recurring annual costs are about $850 per facility ($111.18 * 3.25 + $149.98 * 3.25 = $
848.77). Because there are about 9,800 facilities covered by the rule (Ref. (2)), the total annualized
documentation costs to these firms will be about $8.3 million ($848.77 * 9,759 = $8,283,146).
Businesses that are exempt from the rule because they are very small businesses must be able to
demonstrate to FDA with documentation that the facility qualifies for the exemption. We estimate that
this preparation and updating of files will take one individual at the level of an operations manager
between zero and one hour, with a mean estimate of 30 minutes, each year.
At a time cost of $111.18 per hour, the annual costs of documentation are about $56 ($111.18 *
.5 = $55.59). Because there are about 18,000 firms that are exempt because they are very small
businesses (Ref. (2)), the total annualized costs to these firms for documenting their exemption will be
about $1.0 million ($55.59 * 18,080 = $1,005,067).
g. Costs to Foreign Firms
There are about 61,000 foreign food manufacturers registered to import food into the U.S. (Ref
(7)). Some of these facilities will also incur costs as a result of the rule. We estimate that the distribution
28

of foreign facilities is similar to that of domestic facilities in ownership structure, size, and type. In that
case, the proportion of domestic and foreign facilities that the rule applies to is the same. Because we
lack survey data about baseline foreign facility food defense practices and the likely costs to incorporate
all the changes to comply with the rule, we estimate the costs by assuming that the average costs will be
the same for foreign and domestic facilities; they will have the same proportion of baseline practices and
the same proportion of covered and exempt facilities. Foreign facilities are likely to have lower labor
costs, but also lower adoption rates, so our best estimate of the average cost per foreign facility is that it
would be the same as the average cost per domestic facility.
Because about 9,800 of the 28,000 domestic manufacturing facilities have more than $10 million
in annual sales and are covered by this rule, we estimate that the rule also applies to about 21,000
foreign facilities (9,759/28,000 * 61,000 = 21,261).
The average annualized cost of the rule for domestic facilities that the rule applies to is about
$12,000 ($117,493,636 / 9,549 = $12,040). The total estimated annualized cost to foreign firms is then
about $260 million ($12,040 * 21,261 = $255,968,278 ). The costs are $250 million when annualized at
3%, and the initial costs are $550 million.
h. Costs to FDA
FDA will incur costs to enforce this rule. These costs include setting up an inspection system,
training inspectors, conducting regular inspections of food defense activities, and taking action against
producers who are not complying with the rule. While we are currently in the process of developing a
comprehensive compliance program in order to implement this rule, we were unable to estimate these
costs. We do not know what the inspection system will be, how many food defense inspectors will be
trained, how many food defense inspections FDA will undertake, or what the probability of enforcement
action is.
i. Total Costs
The total cost of the rule to producers, annualized over 10 years at a 7 percent discount rate, is
about $380 million. With a 3 percent discount rate, the annualized cost is about $360 million. The firstyear cost is about $800 million. Counting only domestic firms, the total annualized costs are $120
million, with initial costs of $260 million. The average annualized cost per covered facility is $12,000,
and the average annualized cost per covered firm is about $36,000.

29

30

The following table shows, for each component of the rule, the total first-year cost and the
annualized cost at 3 percent and 7 percent discount rates. It also shows the average costs per exempt and
covered firms. Totals are in millions of dollars, and averages are in dollars:
Table 4.—Annual, Initial, and Annualized Costs
Cost ($Millions)
Exempt Firms Learning: One Time
Exempt Firms Documentation: Annual
Exempt Domestic Firm Subtotal
Exempt Firm Average ($)
Covered Firms Learning: One Time
Creating Food Defense Plan: One Time
Updating Food Defense Plan: Annual
Initial Mitigation: One Time
Mitigation: Annual
Monitoring, Corrective Action, Verification: Annual
Initial Training: One Time
New Employee Training: Annual
Covered Facilities Documentation: Annual
Covered Domestic Firm Subtotal
Covered Domestic Firm Average ($)
Subtotal (Domestic Industry Cost)
Cost to Foreign Firms
Cost to FDA
Total

10

First
Annualized Annualized
Year
3%
7%
$
5
$
1
$
1
$
1
$
1
$
1
$
6
$
2
$
2
$334
$ 88
$ 95
$
21
$
2
$
3
$
31
$
4
$
4
$
6
$
6
$
$
98
$
11
$
14
$
14
$
14
$
14
$
62
$
62
$
62
$
12
$
1
$
2
$
4
$
4
$
4
$
8
$
8
$
8
$
250
$
113
$
117
$77,000
$35,000
$36,000
$
256
$
115
$
120
$
545
$
247
$
256
Unknown
Unknown
Unknown
10
10
$
801
$
362
$
37510

This total does not include costs to FDA of enforcing the rule.

31

2. Benefits of the Rule
This rule is focused on reducing the potential for intentional adulteration of food at an actionable
process step, i.e., a point, step, or procedure in a food process where a significant vulnerability exists
and at which mitigation strategies can be applied and are essential to significantly minimize or prevent a
significant vulnerability. This reduction can be from detecting the perpetrators as they attempt the act, or
from deterring an attack because the food supply is known to be harder to contaminate. Deterring an
attack may cause perpetrators to choose an alternate target (Ref. (8)), so the benefit of the rule is based
on the difference in damage between the attack on a large food production facility that is prevented and
the alternate attack on some other target that is conducted instead.
a. General Model
The expected annual benefits of preventing intentional adulteration of food are:
1) the annual likelihood of an attempted attack that will succeed without the rule; multiplied by
2) the likelihood that the otherwise successful attack will be prevented as a result of the rule;
multiplied by
3) the expected damage that the attack would do if it was successful; minus the damage, if any,
of an alternate attack that happens as a result of the perpetrator choosing a different target.
A successful attack is one that is not detected until after the adulterated food has harmed
consumers. Although the rule is intended to reduce the possibility of individuals or groups successfully
using the food supply to harm large numbers of people, the potential benefits of the rule come from
preventing various attack scenarios. Solely for the purpose of this analysis, we define three attack
scenarios and estimate the harm caused in each scenario.
Scenario 1 attacks are those that resemble previous acts of intentional adulteration in the United
States. There have been several documented cases (Ref. (9)) of intentional adulteration of food for

32

reasons other than profit in the United States, but all of these incidents occurred at the retail level, and
none of them resulted in fatalities or widespread illness. 11
Scenario 2 attacks are those that resemble past cases of major outbreaks of foodborne illness in
the United States.
Scenario 3 attacks are those that could be caused by skilled inside attackers with advanced
knowledge of contaminants and the food supply, and the intention to kill as many people as possible.
Such an attack would cause tens or hundreds of thousands of illness cases, and potentially thousands of
deaths.
This rule is designed to prevent Scenario 3 attacks. 12 While it is not intended to prevent Scenario
1 or 2 attacks, there may be collateral benefits in preventing some such attacks.
The benefits of the rule are a reduction in the chances of these attacks being attempted and the
success of the attacks if attempted. We do not have enough information to calculate this reduction in
probability. We have very limited information on the expected number of attempted attacks per year,
and no numerical estimate of how this rule will reduce the chances that each attack is successful. This
means that, for the purposes of this analysis, we are unable to monetize the benefits of the rule.
Therefore, we present a breakeven analysis. We calculate the dollar value of the damage that the
average attack might cause, and subtract the damage multiplied by the probability of an alternate attack,
to find the expected monetized benefit if the rule prevents an attack. We then compare that number to
the annual cost of the rule. This yields the annual reduction in the odds of a successful attack at which
the benefits of the rule outweigh the costs.
We conduct this analysis separately for each attack scenario, presenting the breakeven point for
the rule assuming that it only prevented attacks of that type. It is possible that the rule may prevent

11

While there have been many acts of intentional adulteration outside of the U.S. that have resulted in fatalities, in
all cases that we are aware of, the point of adulteration has occurred close to the point of consumption. These events have
occurred in a post-manufacturing environment, which is outside the scope of this rule. Specifically, there are many reported
examples of fatalities occurring due to post-manufacturing adulteration of food in China where restaurant owners or operators
intentionally adulterated competitors’ food.
12
For discussion of how this rule would prevent these attacks, see our responses to Comments 1 and 6 in the
preamble, which describe the overall framework for the rule and how the requirements within the framework work as a
system to significantly minimize or prevent significant vulnerabilities at actionable process steps.

33

attacks of all three types, but we do not have the information required to adjust the breakeven points to
reflect this.
b. Scenario 1 Attacks
There have been several documented attacks on the U.S. food supply (Ref. (9)), although none of
them occurred at an actionable process step in a covered facility. The recorded attacks on the food
supply in the U.S. have each resulted in several dozen to a hundred illnesses and no fatalities. Future
attacks that also did not occur at actionable process steps would likely cause harm of similar magnitude.
Although the rule is not intended to cover such attacks, the food defense awareness training required by
the rule might result in the prevention of these attacks in covered facilities.
Based on this data (Ref. (9)), we estimate that the average Scenario 1 attack would cause 50
cases of illness, and that each case would cost about $2,000 (Ref. (10)), so that the average health
damage per attack is $100,000 ($2,000 * 50 = $100,000).
We believe that such an attack would cause a recall of the affected food. The average cost of a
small or medium recall is about $10 million, as described by research by the Grocery Manufacturers'
Association (Ref. (11)). If a Scenario 1 attack is prevented, then there would be no alternate attack,
because the attack would be either one of convenience or motivated by a desire to harm one specific
company, and would not be intended to cause wide scale public health harm. Therefore, the benefits per
prevented Scenario 1 attack are about $10 million ($10 + 0.1 = $10.1). Note that the casualty estimates
are based on cases where there was a recall; in the absence of detection and recall, casualties would
likely have been higher and there may have been fatalities.
The annualized costs of the rule are about $380 million. If the actions undertaken as a result of
this rule only prevented Scenario 1 attacks, they would have to prevent 37 or more Scenario 1 attacks
per year for the benefits to be larger than the costs ($376 / $10.1 = 37.25).
c. Scenario 2 Attacks
A Scenario 2 attack is one that produces casualties equivalent to a major outbreak of food-related
illness due to unintentional contamination at a production facility. We estimate that the average Scenario
2 attack would result in about a thousand illnesses and ten fatalities, based on the history of major
outbreaks described in the FDA’s Risk Assessment for Food Terrorism (Ref. (12)). Note that this is a

34

mean, not a median; most major outbreaks cause around a hundred illnesses but public health estimates
for some outbreaks indicated more than 100,000 illnesses (Ref. (12)).
The monetized value of illness from such an attack is about $2 million ($2,000 * 1,000 =
$2,000,000). With a Value of a Statistical Life of $9 million, the monetized value of the deaths is $90
million ($9 * 10 = $90). Such an attack would also likely prompt a major recall of the affected food, and
major recalls are much more expensive than small or medium recalls, costing about $200 million (Ref.
(11)). The total cost of an attack is then $292 million. ($2 + $90 + $200 = $292). Again, the casualties
would likely be higher without the recall.
We do not know the probability of an alternate attack, so we model it as a uniform distribution
with minimum zero and maximum one, with an average estimate that 50 percent of Scenario 2 attacks
on the food supply prevented by this rule will result in an alternate attack on some other target. We do
not know how much damage this alternate attack would cause, but we know that it is expected to cause
at least some damage, and slightly less damage than an attack on the food supply. If an alternate attack
was expected to cause more damage for the same amount of terrorist effort, it would have been chosen
as the target instead of the food supply. Therefore, we estimate the damage caused by the alternate
attack as a uniform distribution with minimum slightly more than zero and a maximum slightly less than
the expected damage of an attack on the food supply, with an average estimate of 50 percent of the
expected damage.
Therefore, the average expected benefits of preventing a Scenario 2 attack on the food supply are
about $220 million ($292 * (1- (0.5 * 0.5)) = $219).
If the actions undertaken as a result of this rule only prevented Scenario 2 attacks, they would
have to prevent 1.7 attacks every year for the benefits of the rule to outweigh the costs ($376 / $219 =
1.72). While the rule is not designed to specifically address all acts of intentional adulteration that may
be possible, we do believe that if an act of intentional adulteration were attempted at an actionable
process step, the mitigation strategies would likely detect or foil the attempt, regardless of the intent of
the adulteration.
d. Scenario 3 Attacks
The hypothetical Scenario 3 is based on an act of intentional adulteration resulting in wide scale
public health harm. FDA has conducted many vulnerability assessments which, among other things,

35

evaluate the potential public health impact of an act of intentional adulteration. We have analyzed a
wide variety of food production scenarios in these assessments, representing a broad cross-section of the
food industry. These assessments resulted in a wide range of public health impact estimates, with some
resulting in significant public health impact estimates. These findings are classified and not available
for inclusion in this document. The open source research by Wein and Liu (Ref. (13)) serve as an
appropriate proxy for evaluating potential public health impact of an intentional adulteration of food
when the intent of the adulteration is to cause public health harm. Consequently, the Wein and Liu
findings serve as an appropriate basis for the Scenario 3 breakeven analysis.
We therefore estimate the damages caused by an attack that causes 5,000 fatalities and 100,000
illnesses. The advanced techniques that would cause a Scenario 3 attack would likely generate average
illness costs higher than the other two scenarios; we estimate that each nonfatal case of illness would
have a cost of about $50,000 (Refs. (10) and (13)). The monetized value of the illnesses is about $5
billion ($50,000 * 100,000 = $5,000,000,000) and the monetized value of the deaths is about $45 billion
(9 * 5,000 = 45,000), for a total health damage of $50 billion ($5 + $45 = $50). As with the Scenario 2
attack, there may be an alternative attack, so the expected health benefit of preventing a large-scale
attack is about $38 billion. (50 * (1 - (0.5 * 0.5)) = 37.7).
There are many expected economic damages from a catastrophic terrorist attack in addition to
the lives lost and illnesses caused. Catastrophic terrorist attacks cause reductions in investment and
consumer confidence, leading to reductions in GDP growth (Ref. (14)). The cumulative damage due to
these indirect effects of terrorism are estimated to be $190 billion, most of which comes from a
recession and a reduction in the growth rate of the economy (Ref. (14)). If the Scenario 3 attack is
prevented, these damages will be prevented, but if an alternate attack of comparable magnitude is
conducted, they will not be, so the expected benefit of preventing indirect damages is about $95 billion
($190 * (1 - 0.5) = $95). The total benefit from preventing a Scenario 3 attack is then about $133 billion.
($38 + $95 = $133).
If the actions undertaken as a result of this rule only prevented Scenario 3 attacks, they would
have to prevent one attack every 350 years for the benefits of the rule to outweigh the costs ($133,000 /
$376 = 353). This is equivalent to the benefits of this rule being greater than the costs if it has a 0.28%
or better annual chance of preventing a Scenario 3 attack ($376 / $133,000 = 0.0028).

36

Counting only the health effects and not the economic damages, the actions undertaken as a
result of this rule would have to prevent one Scenario 3 attack every 100 years for the benefits to
outweigh the costs ($37,700 / $376 = 100).
3. Analysis of Uncertainty
In Table 4 of this document and elsewhere we present the expected costs of the rule as point
estimates. While this is a convenient way to summarize the costs of the rule and explain our calculation,
the use of point estimates neglects the large degree of uncertainty intrinsic to the underlying analysis. In
Table 5 of this document, we present the results of a Monte Carlo simulation of uncertainty for the
eventual annual costs of the rule.
As we explained in the introduction to the Detailed Analysis, many parameters are defined as
probability distributions. In our Monte Carlo simulation, we use samples from the probability
distributions rather than using the mean values. The randomly chosen numbers are used to form a final
estimate. This procedure is repeated 10,000 times, and the results are ranked from lowest to highest. We
report the 5th percentile, mean, and 95th percentile of the simulated results:
Table 5.—Low, Mean, and High Total Cost Estimates and Breakeven Numbers

Initial Cost ($Mil)
Annualized 3% ($Mil)
Annualized 7% ($Mil)
Scenario 1 Attacks per Year
Scenario 2 Attacks per Year
Scenario 3 Years per attack
Scenario 3 Annual Reduction

5th
Mean
95th
Percentile
Percentile
$ 683
$ 802
$ 933
$ 267
$ 363
$ 475
$ 280
$ 376
$ 488
28
37
48
1.3
1.7
2.2
474
353
272
0.21%
0.28%
0.37%

Tables 6 and 7 show the low and high estimates, respectively, for all numbers in Table 4. All
numbers in these tables are from simulation runs. The subtotals and totals are not the sum of the
individual cost numbers. Any total obtained by adding up the 5th or 95th percentile in each cost category
would be an extremely low-probability number.

37

Table 6.—Annual, Initial, and Annualized Costs, 5th Percentile
Cost ($Millions)
Exempt Firms Learning: One Time
Exempt Firms Documentation: Annual
Exempt Domestic Firm Subtotal
Exempt Firm Average ($)
Covered Firms Learning: One Time
Creating Food Defense Plan: One Time
Updating Food Defense Plan: Annual
Initial Mitigation: One Time
Mitigation: Annual
Monitoring, Corrective Action, Verification: Annual
Initial Training: One Time
New Employee Training: Annual
Covered Facilities Documentation: Annual
Covered Domestic Firm Subtotal
Covered Domestic Firm Average ($)
Subtotal (Domestic Industry Cost)
Cost to Foreign Firms
Cost to FDA
Total

First Year
$
1
$
0
$
1
$ 78
$
15
$
22
$
$
97
$
13
$
34
$
1
$
0
$
3
$
213
$ 66,000
$
219
$
464
Unknown
$
683

3%
$
0
$
0
$
0
$ 27
$
2
$
3
$
4
$
11
$
13
$
34
$
0
$
0
$
3
$
83
$ 26,000
$
85
$
182
Unknown
$
267

7%
$
0
$
0
$
1
$ 30
$
2
$
3
$
4
$
14
$
13
$
34
$
0
$
0
$
3
$
87
$ 27,000
$
89
$
190
Unknown
$
280

38

Table 7.— Annual, Initial, and Annualized Costs, 95th Percentile
Cost ($Millions)
Exempt Firms Learning: One Time
Exempt Firms Documentation: Annual
Exempt Domestic Firm Subtotal
Exempt Firm Average ($)
Covered Firms Learning: One Time
Creating Food Defense Plan: One Time
Updating Food Defense Plan: Annual
Initial Mitigation: One Time
Mitigation: Annual
Monitoring, Corrective Action, Verification: Annual
Initial Training: One Time
New Employee Training: Annual
Covered Facilities Documentation: Annual
Covered Domestic Firm Subtotal
Covered Domestic Firm Average ($)
Subtotal (Domestic Industry Cost)
Cost to Foreign Firms
Cost to FDA
Total

First Year
$
10
$
2
$
11
$ 589
$
26
$
42
$
$
98
$
16
$
96
$
30
$
10
$
14
$
291
$ 90,000
$
297
$
635
Unknown
$
932

3%
$
1
$
2
$
3
$ 150
$
3
$
5
$
9
$
11
$
16
$
96
$
3
$
10
$
14
$
149
$ 46,000
$
151
$
324
Unknown
$
475

7%
$
1
$
2
$
3
$ 161
$
4
$
6
$
9
$
14
$
16
$
96
$
4
$
10
$
14
$
153
$ 47,000
$
155
$
334
Unknown
$
489

39

G. Analysis of Regulatory Alternatives
We have identified five regulatory alternatives:
1. No action;
2. The rule;
3. The rule, with requirements for dairy farms;
4. The rule, but with a different definition of very small business; and
5. Prescribing a simpler and less flexible rule.
1. No Action
Under this option, FDA would rely on
•

current FDA guidances for industry (Ref. (15)),

•

voluntary adoption of some or all provisions of the regulation,

•

new State and local enforcement activity to bring about a reduction of potential harm
from adulterated foods, or

•

the tort system, with litigation or the threat of litigation serving to bring about the goals
of the rule.

This option is not legally viable because Sections 103 and 106 of FSMA require us to establish
regulations to protect against the intentional adulteration of food. Moreover, we believe that this option
would not minimize the risk of food-related illnesses, including serious adverse health consequences or
death from intentional adulteration of food. As explained in the ‘Need for Regulation’ section, using the
tort system will fail to induce optimal investment, because the damages are larger than the value of the
company. The advantage of this option is that there would be no costs to food producers, but the
disadvantage is that there would also be no benefits to society.
2. The Rule
The costs and benefits of the actions required by the rule are described in the Detailed Analysis
section above.
3. The Rule with Dairy Farm Requirements
40

One alternative is adding requirements for dairy farms to the rule. We have identified significant
vulnerabilities on dairy farms. Any potential requirement to address these vulnerabilities would generate
additional costs, and also the additional benefit of protecting the milk supply on the farm. We estimate
the potential costs in this section, and present a breakeven analysis. The example calculations assume
that all of the approximately 49,000 dairy farms that are licensed to sell milk would be covered, and the
summary table shows how costs would change with rule coverage based on different herd sizes.
As discussed in the rule, at this time there are no strategies that limit access to milk that are
appropriate and practical to require for all farms. However, for the purposes of this regulatory
alternative, we estimate that the primary cost of any such strategy would be to cause a loss in
productivity. Farm workers, milk truck drivers, veterinarians, and state milk inspectors (in some states)
would need to spend time complying with the required mitigation strategies.
It is likely that several mitigation strategies would be needed to limit access to milk while it is on
the farm because solely locking the bulk tank is ineffective in preventing access to the milk. We present
a cost estimate for one, very simple mitigation strategy (adding a lock on the milk tank) below. Other
mitigation strategies would cost several times as much in both capital costs and lost productivity.
Therefore, these cost estimates should be considered a minimum; the actual cost would be several times
as much as we estimate below.
We estimate that a mitigation strategy to address a potential vulnerability at dairy farms will
result in, on average, fifteen minutes of lost productivity per day on each farm affected by the
alternative. Dairy farms operate every day of the year. Fifteen minutes lost per day means 91 hours lost
per year (15*365/60 = 91.25). The mean hourly wage in the agricultural industry is $12.94 (Ref. (16)),
and we double this to account for benefits and overhead, to value the time lost at $25.88 per hour
($12.94*2 = $25.88). This means that the value of the total time lost would be about $2400 per farm
($25.88 *91.27 = $2,362).
In addition to this lost productivity, we estimate average initial costs of about $5,000 per dairy as
a result of this alternative for startup costs, such as education and training, and/or the purchase and
installation of capital equipment (Ref. (6)). This results in annualized costs of about $700 per business.
We then add the productivity and capital costs to estimate an average annual cost per dairy farm of about
$3,100 ($2,362 + $712 = $3,073).

41

There are about 49,000 dairy farms licensed to ship milk commercially (Ref. (17)), so the total
annual cost of a dairy farm requirement would be about $150 million ($3,073 * 49,331 = $151,615,746).
The alternative might apply to all dairy farms, or only to dairy farms with more than a certain
number of milk-producing cows. The following table shows the cost of a dairy farm provision at various
herd size exemptions:
Table 8.—Dairy Farm Rule Costs by Coverage

Rule Coverage
All Farms
Licensed to sell
30 or more cows
50 or more cows
100 or more cows
200 or more cows

Farms
Cost
Covered ($Mil)
58,000
$ 170
49,000
$ 150
39,200
$ 120
29,500
$
91
15,000
$
46
7,100
$
22

If there were strategies that limit access to milk that were also appropriate and practical to
require for all farms at this time, the benefits of requiring these strategies to be implemented on farms
would come from a reduction in the chances of public health harm as a result of contamination of the
milk supply on farms. As with the implemented provisions for manufacturers and processors, we do not
know how many instances of intentional adulteration there will be in the future. Therefore, we present a
breakeven analysis. For descriptions of the scenarios, see the Detailed Analysis.
If this provision only prevented Scenario 1 attacks, which would have an average benefit of
about $10 million per prevented attack, it would have to prevent fifteen attacks every year on the milk
supply at dairy farms for the benefits to outweigh the costs ($152 / $10 = 15.2).
If this provision only prevented Scenario 2 attacks, which would have an average benefit of
about $220 million per prevented attack, then it would have to prevent 0.7 attacks per year on the milk
supply at dairy farms for the benefits to outweigh the costs ($152 / $220 = 0.69).
If this provision only prevented Scenario 3 attacks, which would have an average benefit of
about $133 billion per prevented attack, then it would have to prevent one such attack on the milk
supply at dairy farms every 870 years for the benefits to outweigh the costs ($133,000/$152 = 873).

42

4. A Different Very Small Business Size Threshold than the Rule’s $10 Million
Another alternative is to choose some level other than $10 million in annual sales for the
definition of very small businesses. Choosing a higher cutoff would lower the number of facilities
required to implement the rule, which would lower costs, but would result in a larger percentage of food
being produced by businesses that are not required to implement the regulation.
The following table shows the estimated number of domestic firms and facilities covered and the
total cost to domestic firms at a 7 percent discount rate for the actions required by the rule at various
cutoffs for very small business. It also shows the share that would be covered by the regulation, where
the total is defined as food produced domestically by registered facilities that are estimated to have
actionable process steps. The table was generated by using facility-level data from Dun & Bradstreet’s
Global Business Database (Ref. (2)), as described in the Detailed Analysis:
Table 9.—Other Facility Exemptions
Cutoff
($Mil)
5
10
20
30
40
50

Facilities Firms
Domestic
Share
Covered Covered
Cost ($Mil) Covered
11,353
4,678
$ 139
99.0%
9,759
3,247
$ 120
98.3%
8,972
2,592
$ 110
97.7%
8,440
2,151
$ 103
97.2%
8,021
1,832
$ 98
96.7%
7,646
1,563
$ 93
96.2%

All cost numbers are produced using the same procedures described in the Detailed Analysis
below. We do not have similar data on foreign firms, but we estimate that the number of firms and
facilities, and the total costs, would be roughly doubled if foreign firms were included.
Individuals or groups intending to cause harm would likely target the product of relatively large
facilities, especially firms whose brand is nationally or internationally recognizable. However, if
facilities were attacked at random, then the benefits of this rule would be proportional to the share
covered. Going down to a $5 million sales cutoff would increase domestic costs by $19 million a year
while increasing coverage by 0.7%. Going up to a $20 million sales cutoff would decrease costs by $10
million a year while decreasing coverage by 0.6.
5. Prescribing a Simpler and Less Flexible Rule
43

Another alternative would be the provisions as originally proposed, which reduces complexity
and learning costs by prescribing a simpler and less flexible rule. This alternative would have reduced
the costs to learn about the rule and generate a food defense plan. However, it increases costs because
the alternative does not allow facilities to take into account some existing mitigation strategies when
identifying actionable process steps. Additionally, this alternative reduces flexibility for food defense
monitoring, corrective actions, and verification activities.
We estimate that this alternative would have the following effects:
1. The average time for the operations manager in covered firms to learn about the rule
would decrease from 30 to 20 hours.
2. The average time for exempt firms to learn about the rule would decrease from 2.5 to 2
hours.
3. The average time to identify actionable process steps would decrease from 20 to 15
hours.
4. Facilities would need to use the nine least costly mitigation strategies of the ten analyzed
above, instead of the eight least costly strategies, because this alternative did not allow
facilities to take into account existing mitigation strategies when identifying actionable
process steps.
5. The average time supervisors spend on monitoring and corrective action would increase
from 175 to 200 hours, because more mitigation strategies would be required and
facilities would have less flexibility in choosing what strategies to use.
Given these effects, this alternative would increase the annualized domestic costs of the rule by
about $22 million and foreign costs by about $47 million, for a total cost increase of about $69 million.
We believe that this alternative does not provide enough benefits to justify these costs.

44

Regulatory Flexibility Analysis
The Small Business Regulatory Flexibility Act requires agencies to analyze regulatory options
that would minimize any significant impact of a rule on small entities. Small entities have fewer
resources to devote to regulatory compliance and, therefore, may be more affected by regulatory
compliance costs. The agency believes that the rule will have a significant economic impact on a
substantial number of small entities.
1. Number of Small Entities Affected
The Small Business Administration defines food manufacturers as “small” according to their
number of employees. For the most part, food manufacturers employing 500 or fewer persons are
considered small businesses. However, there are some particular food manufacturing industry segments
where the employee maximum is higher (750 or 1,000 employees). For the purposes of this rule-making,
we have defined a very small business as having annual sales of less than $10 million on an annual
basis, and a small business as a business employing fewer than 500 persons.
We find that there are 2,887 firms with more than $10 million in sales, and less than 500
employees, that are covered by this rule (Ref. (2)). We also find that there are 18,080 firms that have
less than $10 million in sales, and are exempt from the rule, but will have to learn about the rule and be
prepared to document their exemption.
The facilities that are part of firms with more than $10 million in sales produce 98 percent of the
total sales volume of manufactured packaged food, and the exempt facilities produce two percent. Two
percent of the money that consumers spend on manufactured packaged food is spent on food that is not
covered by the regulation.
2. Costs to Small Entities
The annualized costs per entity due to this rule for a firm affected by the rule are about $13,000
for a one-facility firm with 100 employees. This includes learning costs of about $900 per firm; food
defense plan, mitigation, food defense monitoring, corrective action, and verification, and
documentation costs of about $11,200 per facility, and worker training costs of about $500. For more
information about these numbers, see the appropriate sections of the Detailed Analysis.
The annualized costs for a very small business affected by the rule but exempted from its
provisions are about $95 per firm. This includes an annualized cost of about $40 to learn about the rule,
45

and an annual cost of about $56 to maintain documentation that was relied upon to demonstrate that the
facility meets the very small business exemption. For more information about these numbers, see the
appropriate sections of the Detailed Analysis.
3. Regulatory Flexibility Options
This rule is effective 60 days after publication in the Federal Register, with staggered compliance
dates. We recognize that businesses of all sizes may need more time to comply with the new
requirements established under FSMA. Therefore, facilities, other than small and very small businesses,
that are subject to part 121 will have 3 years after the effective date to comply with part 121. Small
businesses will have 4 years after the effective date to comply with part 121 (see section IV.B of the rule
preamble for a discussion of the definition of a “small business”). With respect to very small businesses
as discussed in section IV.E of the preamble, we are exempting very small businesses from the
requirements of part 121, except that such businesses must, upon request, provide for official review
documentation that was relied upon to demonstrate that the facility meets this exemption. Very small
businesses will have 5 years after the effective date to comply with §121.5(a) (see section IV.B of the
preamble for a discussion of the definition of a “very small business”).
Allowing small businesses more time to comply with the requirements of the rule would save
them money, but we do not know what the cost savings would be and we do not know how this would
affect the risk of an attack on the food supply.
4. Description of Recordkeeping and Recording Requirements.
The Regulatory Flexibility Act requires a description of the recordkeeping required for
compliance with this rule. Documentation must be established and kept for the certain purposes
described in the rule. Discussion of the costs of recordkeeping, record creation, and reporting can be
found in corresponding sections of the analysis.

46

Unfunded Mandates
Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires that agencies prepare a
written statement, which includes an assessment of anticipated costs and benefits, before proposing “any
rule that includes any Federal mandate that may result in the expenditure by State, local, and tribal
governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for
inflation) in any one year.” The current threshold after adjustment for inflation is $144 million, using the
most current (2014) Implicit Price Deflator for the Gross Domestic Product. FDA has determined that
this rule is significant under the Unfunded Mandates Reform Act. FDA has carried out the cost-benefit
analysis in preceding sections. The other requirements under the Unfunded Mandates Reform Act of
1995 include assessing the rule’s effects on:
• Future costs;
• Particular regions, communities, or industrial sectors;
• National productivity;
• Economic growth;
• Full employment;
• Job creation; and
• Exports.
We have determined that this rule will not have a significant impact on any of these variables.

47

Small Business Regulatory Enforcement Fairness Act
The Small Business Regulatory Enforcement Fairness Act of 1996 (Public Law 104-121) defines
a major rule for the purpose of congressional review as having caused or being likely to cause one or
more of the following: An annual effect on the economy of $100 million or more; a major increase in
costs or prices; significant adverse effects on competition, employment, productivity, or innovation; or
significant adverse effects on the ability of United States-based enterprises to compete with foreignbased enterprises in domestic or export markets. In accordance with the Small Business Regulatory
Enforcement Fairness Act, the Office of Management and Budget (OMB) has determined that this rule
is a major rule for the purpose of Congressional review.

48

References
1. FDA Food Safety Modernization Act of 2011. Pub. L. No. 111-353 §§ 103, 105, 106. 2011.
2. Dun & Bradstreet. Dun & Bradstreet Global Business Database. 2014.
3. Agroterrorism: Where Are We in the Ongoing War on Terrorism? Tamara M Crutchley, et
al. s.l. : Journal of Food Protection, 2007.
4. Bureau of Labor Statistics. May 2014 National Industry-Specific Occupational Employment
and Wage Estimates. NAICS 311000 - Food Manufacturing. [Online]
http://www.bls.gov/oes/current/naics3_311000.htm.
5. FDA CFSAN. Expert Elicitation on Food Defense Time Costs. 2015.
6. Institute of Food Technologists. Modeling the Costs of Food Defense Practices: Prototype
Model. 2011.
7. Food and Drug Administration. Food Facility Registration Module.
8. Adversarial Risk Analysis for Counterterrorism Modeling. Rios, Jesus and Insua, David
Rios. s.l. : Risk Analysis, 2012.
9. Risk Analysis of Chemical, Biological, or Radionuclear Threats: Implications for Food
Security. Mohtadi, Hamid and Murshid, Antu. 2009, Risk Analysis.
10. Food and Drug Administration. Preventative Controls for Human Food Regulatory Impact
Analysis.
11. Grocery Manufacturers' Association. Capturing Recall Costs: Measuring and Recovering
the Losses. [Online] http://www.gmaonline.org/filemanager/images/gmapublications/Capturing_Recall_Costs_GMA_Whitepaper_FINAL.pdf.
12. FDA Center for Food Safety and Applied Nutrition. Risk Assessment for Food Terrorism
and Other Food Safety Concerns. 2003.
13. Analyzing a bioterror attack on the food supply: The case of botulinum toxin in milk. Wein,
Lawrence M. and Liu, Yifan. 2005, PNAS.

49

14. Stinson, Thomas. The National Economic Impacts of a Food Terrorism Event: Preliminary
Estimates. [Online] 2005. http://www.ift.org/knowledge-center/read-ift-publications/sciencereports/conferencepapers/~/media/Knowledge%20Center/Science%20Reports/Conference%20Papers/3Stinson.pdf.
15. Food and Drug Administration. Food Defense Guidance. [Online]
http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodDefens
e/default.htm.
16. Bureau of Labor Statistics. May 2012 National Industry-Specific Occupational
Employment and Wage Estimates. Sector 11 - Agriculture, Forestry, Fishing and Hunting. [Online]
http://www.bls.gov/oes/current/naics2_11.htm.
17. USDA National Agricultural Statistics Service. Farms, Land in Farms, and Livestock
Operations 2012 Summary. [Online]
http://usda01.library.cornell.edu/usda/current/FarmLandIn/FarmLandIn-02-19-2013.pdf.
18. International Dairy Foods Association. Voluntary Guidelines for Security of Raw Milk at
the Farm. [Online] http://www.nmpf.org/files/file/Milkhouse_security_w_logos.pdf.
19. Dun & Bradstreet. Dun & Bradstreet Global Business Database. 2011.
20. RTI International. FDA Reformulation Cost Model. 2015.

50