CARVER+Shock and Business Process Management in Improving Food Safety of Primary Production

Abstract

Context: Food safety is essential for every human. It determines public health, nutrition, elimination of hunger, and the promotion of sustainable agriculture. It is crucial for sustainable production, consumption, and international food trade. Ensuring food safety is the fundamental challenge of the 21st century. Food safety is often related to food defense and includes protection against intentional contamination with various chemical, biological, or other harmful substances. By introducing food protection tools and methods, any company reduces risk and creates an opportunity to generate more significant and reliable profits and improved production for society. One such method could be the CARVER+Shock. The method is an offensive targeting prioritization tool that has been adapted for use in the food sector. Objective: The article aims to present the experience of the first implementation of CARVER+Shock in a Polish primary production company, to improve the approach to food safety and food defense. Methods: The article is a case study. Descriptive analysis was performed to analyze legal acts and safety management standards in food defense. The authors used the CARVER+Shock expert method to estimate companies’ vulnerability. CARVER is an acronym for Criticality, Accessibility, Recoverability, Vulnerability, Effect, Recognizability. The visualization and risk analysis were made using business process management and business process modeling (VACD diagram) Results and conclusions: Primary production enterprise dealing with the cultivation and confectioning of the pre-treatment and sale of peeled onions for further processing purposes was examined. Five essential stages of the production process were assessed, and risks were assigned. Recognizability and criticality turned out to be the most crucial attribute of CARVER+Shock. Overall, the study showed that the company was not fully prepared for the threat posed by food terrorism. The organization did not have any procedures describing how to proceed during deliberate attacks. In addition, workers had low awareness of food defense throughout the food chain. Based on these conclusions, several detailed improvement actions were formulated. The results obtained from the pioneering application of the CARVER+Shock method for a Polish primary production company may constitute a benchmark for other sectors of the food industry, both domestically and abroad. Significance: The article describes the results of the first Polish attempts to use CARVER+Shock and business process management to improve the approach to food safety in a primary production enterprise.

1. Introduction

Enterprises constantly need innovative food security, safety, and food defense solutions focusing on sustainability. One solution is CARVER+Shock. To support the use of CARVER+Shock, an introduction to business process management (BPM) is necessary.

The paper presents one of the first attempts to implement the CARVER+Shock and BPM approaches in a Polish primary production company.

2. Literature Review

Food safety should be considered multidimensionally across many factors throughout the food chain (Figure 1). These include accidental threats, intentional threats (food fraud and food attacks), and supply chain security [1,2,3,4,5,6,7]. The food chain consists of all entities involved in the production and circulation of food, and special attention should be paid to ensuring safety in each of the stages. The first challenge in ensuring food safety is encountered at the primary production stage. According to Regulation (EC.) No 178/2002, “‘primary production’ means the production, rearing or growing of primary products including harvesting, milking and farmed animal production prior to slaughter. It also includes hunting and fishing and harvesting wild products” [8].

Annex 1 to Regulation (EC.) No 852/2004 also includes a description of the production stages including “the transport, storage, and handling of primary products at the place of production, provided that this does not substantially alter their nature” [9]. Primary products relate to products of plant or plant-like origin (cereal, fruits, vegetables, herbs, farmed mushrooms), or of animal origin (eggs, raw milk, honey, fishery products), harvested in their natural environment, i.e., growing in natural conditions (mushrooms, berries, snails, etc.).

Incidental hazards at the primary production stage can be microbiological, chemical, or physical. “Annex I” of (EC.) No. 852/2004 of 29 April 2004 [9] also specifies general hygiene rules for primary production and related operations. Another EU legal document, Guidelines for Mitigating Microbiological Risks, identifies the main microbiological risk factors:

• Environmental factors include animal reservoirs—animal husbandry, access to fruit and vegetable growing areas, and contact with pets, pests, or wildlife fauna and flora.
• Fertilizers and plant protection products—use of untreated or insufficiently cleaned organic soil improvers, manure or compost.
• Agricultural water—use of contaminated water for irrigation, or pesticides and fungicides.
• Hygiene and health status of workers—contamination by workers.
• Hygienic conditions in primary production plants—contamination from equipment during or after harvest on the farm. [10,11,12]

Chemical hazards and biocides apply to the primary production stage of plant protection products. Physical hazards are related to foreign bodies that can enter food during harvesting and storage due to improperly maintained machinery and equipment or employee mistakes. Intentional threats in the field of food fraud include practices such as:

• unapproved enhancements (adding substances to improve properties)
• substitution (replacing ingredients with cheaper substitutes)
• dilution (enrichment of more expensive raw materials with cheaper substitutes)
• concealment (using components to conceal inferior products) [10,13,14].

Food quality and safety management standards in primary production, such as GlobalG.A.P., ISO 22000, BRC, and IFS, include no obligatory guidelines on preventing threats related to a deliberate attacks on food. However, European food policy aims to ensure food safety by promoting sustainable consumption and diet, reducing food waste, and counteracting fraud in the food industry [15]. That is impossible without proper rules of conduct for food defense. This area has been strongly emphasized and strengthened in the USA by using various tools. The USDA provides access to the mechanisms facilitating the preparation of a company for defence against an intentional attack on food [16]. Larson assigned farmers greater responsibility for food safety and defense [17].

Some definitions should be clarified at this stage: Food fraud is a crime committed for financial gain; intentional adulteration or food attack is contamination of food for the purpose of causing harm to consumers, and food defense is the protection of food from malicious adulteration, such as acts of terrorism or extortion [17].

Within the framework of legal requirements, the protection of food against incidental hazards is supported by applying the requirements of the HACCP system (Hazard Analysis and Critical Control Point), which is obligatory under article 5 of Regulation (EC.) No 852/2004 [9]. Preventing intentional threats in food fraud is also reinforced by legal requirements. In Poland, the Food and Nutrition Safety Act of 25 August 2006 regulated fraudulent food issues [18]. EU law has not so far explicitly addressed food defense.

To ensure food safety and food defense, enterprises operating in the food chain have usually implemented quality management standards and food safety requirements, such as Global GAP point AF 10 Food defense, ISO/TS 22002-1 point 18 Food defense, biovigilance, and bioterrorism, BRC point 4.2 Site security and food defense, IFS food point 6 Food defense plan [19,20,21,22].

Ensuring food safety is a problem of particular importance, because it is related to human health and life. Currently, more and more situations cause the risk of threats affecting food safety, and the manufacturer does not influence the risk of food terrorism. Since the beginning of the 21st century, food terrorism and related issues have became critical factors shaping the policies of the UN and governments almost all over the world. In 2015, the UN introduced Agenda 2030, defining 17 sustainable development goals. The second of these goals, Zero hunger [3], includes activities related to food safety threats, significantly counteracting food poisoning, and detecting food terrorism. That issues grew from 2001 to 2004, i.e., after the attacks on the World Trade Centre in New York, and from 2015 to 2017. Since 2019, the COVID-19 pandemic has made people even more aware of the importance of threats to human health. Since then, issues associated with food terrorism have been kept up-to-date and have been more frequently mentioned in the context of health protection. They can affect significant human populations, primarily when ingredients used massively in production processes in the food industry become infected.

According to Kinsey et al. [23], intentional chemical or biological contamination of food was the fifth largest concern about disasters, after passenger plane crashes, public transport attacks, and the destruction of national monuments, and before the disruption of the power grid or the release of chemical or biological agents in crowded public places [23]. In 2002, the World Health Organization issued a resolution in which serious concern was expressed about threats to the civilian population from the deliberate use of biological, chemical, or radio-nuclear agents. This document defines food terrorism as “the act or threat of deliberately contaminating food intended for human consumption with chemical, biological or radio-nuclear agents to injure or kill civilians and/or disrupt social, economic, or political stability” [24]. Chemical agents are fabricated or natural toxins, biological agents, or infectious or non-infectious pathogenic microorganisms, including viruses, bacteria, and parasites [25]. Radio-nuclear agents are defined as radioactive chemicals capable of causing injury when present in excessive amounts. The definition covers all food, and includes the water used to prepare food, as well as bottled water [26].

The most frequently cited potential effects of food terrorism are: (a) Disease and death; (b) Economic and trade impact, such as disrupting or preventing food supply chains from functioning; (c) Impact on public health services, in particular, disrupting the health care system by causing an abrupt demand for medical services in a specific area; (d) Social and political implications, relating to destabilizing a specific area by causing fear to the public that food or drinking water may become contaminated. Alternatively, there may be a threat of extortion that such contamination may occur if demands are not met. [27,28,29]. The WHO has emphasized the importance of the problem, and suggested a solution in the form of comprehensive prevention and response systems in the food industry, including [30,31]:

• Primary farming and harvesting—these systems cover both small family farms and large agricultural businesses. It is necessary to ensure the safety of raw materials used in agricultural production, from the soil condition, seeds, and fertilizers in plant production to animal feed in livestock production. In particular, WHO experts have suggested the need to take samples of finished products, test them, and, if necessary, inform the relevant state authorities.
• Food processing.
• Food logistics, including storage and transportation.
• Wholesale and retail distribution.
• Gastronomy.
• Monitoring and recalling products on the market.

The potential impact of a food terrorism incident can be estimated by analyzing the many documented examples of unintentional accidents or food poisoning and the scale of the spread of food-borne diseases [32,33] (

Table 1. Worse foodborne events.

Event	Food/Poison	Infected	Deaths
2017–2018 South African listeriosis outbreak	Processed meat	1060	216
2017 Valley Oak Nacho Cheese Botulism outbreak	nacho cheese	10	1
2015–present European listeriosis outbreak	Frozen corn suspected	32	6
2013–2014 Danish listeriosis outbreak	Spiced lamb roll, pork, sausages, bacon, liver pâté etc.	40	15
2011 Germany E. coli O104:H4 outbreak	fenugreek sprouts	4000	53
2011 United States listeriosis outbreak in cantaloupes	cantaloupe	146	303
2008 Canada listeriosis outbreak	cold cuts	50	22
2008 United States salmonellosis outbreak in peanuts	peanuts	200	9
2006 North American E. coli O157:H7 outbreak in spinach	spinach	205	3
2005 South Wales E. coli O157 outbreak	meat	157	1
2003 United States hepatitis A outbreak	green onions	555	3
2002 United States listeriosis outbreak in poultry	poultry	50	8
1998 United States listeriosis outbreak	cold cuts and hot dogs	100	20
1996 Wishaw (Scotland) E. coli outbreak	meat	496	21
1996 Odwalla E. coli outbreak	unpasteurized apple juice	66	1
Salmonella in ice cream	ice cream	224	0
1993 Jack in the Box E. coli outbreak	undercooked hamburgers	700	4
1985 California listeriosis outbreak in cheese	queso fresco	86	50
1985 United States salmonellosis outbreak in milk	milk	5295	9
2008 Chinese milk scandal	melamine and urea	300,000	6
1981 Spain rapeseed oil toxicity	possibly aniline	25,000	600
1971 Iraq poison grain disaster	methylmercury	650	650

).

Therefore, the fundamental issue is developing an early warning system for possible food safety risks. This is complex, as many threats are new and may be difficult to identify.

Standard risk identification and threat analysis systems can identify threats that frequently occur,, but do not work for threats that are non-standard and uncommon. Therefore, it is essential to focus on monitoring, assessing, and managing the risks concerning non-standard food contamination threats.

The Spink and Moyer matrix may help illustrate the differences between critical terms related to quality, safety, and food protection (

Table 2. The food risk matrix distinguishes between food quality, food safety, food fraud, and food defense. Source: [34].

Food Quality	Food Fraud	Motivation: Economic Gain
Food Safety	Food Defence	Harm including health, economic, terror
Unintentional	Intentional

).

The authors also specified motives related to counteracting threats. The nature of the actions taken, taking into account unintentional and intentional steps, was indicated. The matrix recognizes deliberate efforts that cause risks related to fraud in the food industry, and hazards in the circulation of food [34].

Because the present study concerns a processing enterprise, the authors focused on regulations and standards concerning this type of activity.

In response to the needs of the agri-food sector, the BSI has developed the publicly available PAS 96 specification, which helps to prevent deliberate terrorist attacks in food manufacturing, processing, shipping, wholesaling, retailing, and catering industry facilities. [35,36,37,38]. PAS 96 emphasizes the need to develop contingency plans that are designed and implemented well before any event occurs, to improve resistance to attack in all parts of the production and supply chain. PAS 96 specifies types of attackers and identifies several specific threats, including extortion, malignant contamination, cybercrime, espionage, economically motivated falsification, and counterfeiting.

PAS 96 introduces the Threat Assessment Critical Control Point (TACCP), a risk management framework closely related to HACCP, which food businesses should use as part of a broad risk management strategy to:

• Reduce the likelihood of a deliberate attack
• Reduce the impact of an attack on a food business
• Provide stakeholders safe production and supply chain [10].

3. Materials and Methods

This study uses qualitative methods to provide a descriptive case study. The main tools for collecting qualitative data were observation, company documentation, the CARVER+Shock method, processes analysis, and direct interviews with the company owner and workers. The case study is the research method inscribed in the specific field of management science, among others [39]. This method’s primary purpose is to depict the best “case” and enables the researcher to carefully examine data in a specific context [40], including a detailed analysis of the case, goals, assumptions, motives, and actions. A case study can involve both quantitative and qualitative data to explain the phenomenon’s process and outcome through comprehensive observation, reconstruction, and analysis of the studied cases. Qualitative researchers prefer qualitative data (words and images), using unstructured interviews more willingly, selecting field observations, and using inductive research leading to the definition of specific hypotheses based on the obtained data, and may be reluctant to test these hypotheses [41]. The case study can be used to describe an enterprise. A comprehensive and multifaceted analysis of a specific case allows an understanding of phenomena analogous to the studied phenomenon, shaping the experience and, as a result, developing the ability to act in real terms in similar circumstances [42].

Some errors and limitations may occur when using a case study approach, leading to differences between the actual state of the phenomenon under investigation and results obtained in the research procedure. The most common errors are insufficient openness, communicativeness, and researcher neutrality (data collection error). A particular threat is the abuse of respondents’ trust, as well as bias in collecting research material, focusing on facts close to the researcher’s position on specific issues, omitting anything that could undermine this position. Another limitation of the method is the small scale of the research, narrowing its subjective scope (sample selection error) [43].

This research aimed to present the use of the CARVER+Shock method to prevent a possible attack on food in a primary production company. CARVER+Shock is an offensive prioritization tool adapted for the food sector [44] and other areas, e.g., post-flood risk assessment [45]. This tool can be used to assess the vulnerability of a system or infrastructure to potential attack. The basic assumption for the method is to think like an attacker to identify the most attractive targets to maximize the attack’s impact. By carrying out such an assessment and identifying the most vulnerable elements in the infrastructure, we can allocate resources to protect the most susceptible areas.

CARVER is an acronym for six attributes used to assess a target’s attractiveness to a potential attack [46]:

• Criticality is a measure of an attack’s impact on public health and the economy. Question: Do I hurt the victims’ economy, health, and ability to fight?
• Accessibility is the ability to physically access and exit an attack location. Questions: How close? How easy to reach the victims? What physical access is available?
• Recovery is the ability to recover from a given system or infrastructure attack. Question: How quickly can victims rebuild?
• Vulnerability is the ease of performing an attack. Questions: Can I damage the target? Is it reinforced or guarded?
• Effect is the amount of loss caused by direct attack, measured by production loss. Question: Do victims have backups or alternatives?
• Recognizability is ease of target identification. Question: Can the attacker recognize and find the target?

CARVER+Shock assesses a seventh attribute that combines an attack’s health, economic and psychological effects, i.e., the Shock impact Question: What kind of psychological effects can it induce for women and children? (

Table 3. CARVER+Shock criticality grading scales. Source: [46].

Criticality Criteria	Scale
“Loss of over 10,000 lives OR loss of more than $100 billion”	9–10
“Loss of life is between 1000 and 10,000 OR loss of between $10 and $100 billion (note: if looking on a company level, loss of between 61 and 90% of the total economic value for which you are concerned)”	7–8
“Loss of life between 100 and 1000 OR loss of between $1 and $10 billion (note: if looking on a company level, loss of between 31 and 60% of the total economic value for which you are concerned)”	5–6
“Loss of life less than 100 OR loss of between $100 million and $1 billion (note: if looking on a company level, loss of between 10 and 30% of the total economic value for which you are concerned)”	3–4
“No loss of life OR loss of less than $100 million (note: if looking on a 1–2 company level, loss of >10% of the total economic value for which you are concerned)”	1–2
Accessibility Criteria	Scale
“Easily accessible (e.g., the target is outside the building, and no perimeter fence). Limited physical or human barriers or observation. The attacker has relatively unlimited access to the target. The attack can be carried out using medium or large volumes of contaminant without undue concern for detection. Multiple sources of information concerning the facility and the target are easily available.”	9–10
“Accessible (e.g., the target is inside the building but in an unsecured part of the facility). Human observation and physical barriers are limited. The attacker has access to the target for an hour or less. The attack can be carried out with moderate to large volumes of contaminant but requires the use of stealth. Only limited specific information is available on the facility and the target.”	7–8
“Partially accessible (e.g., inside building, but in a relatively unsecured, but busy, part of the facility). Under constant possible human observation. Some physical barriers may be present, contaminants must be disguised, and time limitations are significant. Only general, non-specific information is available on the facility and the target.”	5–6
“Hardly accessible (e.g., inside building in a secured part of the facility). Human observation and physical barriers with an established means of detection. Access is generally restricted to operators or authorized persons. Contaminants must be disguised, and time limitations are extreme. Limited general information available on the facility and the target.”	3–4
“Not accessible. Physical barriers, alarms, human observation, and defined intervention means are in place. The attacker can access the target for less than 5 min with all equipment carried in pockets. No useful publicly available information concerning the target.”	1–2
Vulnerability Criteria	Scale
“Target characteristics allow for easy introduction of sufficient agents to achieve an aim.”	9–10
“Target characteristics almost always allow for the introduction of sufficient agents to achieve an aim.”	7–8
“Target characteristics allow 30 to 60% probability that sufficient agents can be added to achieve an aim.”	5–6
“Target characteristics allow moderate probability (10 to 30%) that sufficient agents can be added to achieve an aim.”	3–4
“Target characteristics allow low probability (less than 10%) sufficient agents can be added to achieve an aim.”	1–2
Effect Criteria	Scale
“Greater than 50% of the system’s production impacted”	9–10
“25–50% of the system’s production impacted”	7–8
“10–25% of the system’s production impacted”	5–6
“1–10% of the system’s production impacted”	3–4
“Less than 1% of system’s production impacted”	1–2
Recognizability Criteria	Scale
“The target is recognizable and requires little or no training for recognition.”	9–10
“The target is easily recognizable and requires only a small amount of training for recognition.”	7–8
“The target is difficult to recognize or might be confused with other targets or target components and requires some training for recognition.”	5–6
“The target is difficult to recognize, and it is easily confused with other targets or components and requires extensive training for recognition.”	3–4
“The target cannot be recognized under any conditions, except by experts.”	1–2
Shock Criteria	Scale
“Target has primary historical, cultural, religious, or other symbolic importance. Losing over 10,000 lives. Significant impact on sensitive subpopulations, e.g., children or elderly. National economic impact more than $100 billion.”	9–10
“Target has high historical, cultural, religious or other symbolic importance. Loss of between 1000 and 10,000 lives. Significant impact on sensitive subpopulations, e.g., children or elderly. The national economic impact is between $10 and $100 billion.”	7–8
“Target has moderate historical, cultural, religious, or other symbolic importance. Loss of life between 100 and 1000. Moderate impact on sensitive subpopulations, e.g., children or elderly. The national economic impact between $1 and $10 billion.”	5–6
“Target has little historical, cultural, religious, or other symbolic importance, loss of life less than 100. Minor impact on sensitive subpopulations, e.g., children or elderly. The national economic impact is between $100 million and $1 billion.”	3–4
“Target has no historical, cultural, religious, or other symbolic importance. Loss of life less than 10. No impact on sensitive subpopulations, e.g., children or elderly. National economic impact less than $100 million.”	1–2

).

The target attractiveness is assessed from one to ten based on the seven attribute scales. Lower attractiveness or vulnerability relates to lower values (e.g., 1 or 2), and the higher attractiveness or vulnerability of a target relates to higher values (e.g., 9 or 10). The scales were designed with the assumption that the goal of a terrorist is to achieve mass mortality.

US federal agencies such as the Food Safety and Inspection Service (FSIS) and the Food and Drug Administration (FDA) use CARVER+Shock to assess potential weaknesses in food supply chains from farm to fork. CARVER+Shock can also evaluate the potential vulnerabilities of an individual company’s plant or processes. It shows the most vulnerable targets and helps understand where to focus mitigation measures [46]. Knowing why certain unit operations are particularly favourable targets can help to understand which mitigation measures may be most effective.

CARVER+Shock analysis aims to rank unit operations, not the actual calculated result of the assessment, because the result cannot be transferred along the supply chain. The highest-ranked steps in the process are locations where additional mitigation measures should be applied.

The method is applied in five steps:

• Setting the scenarios and assumptions for the whole analysis. This should include identification of what is supposed to be protected from what type of threats.
• Gathering experts. The team could consist of experts from various specializations: food production, food science, microbiology, epidemiology, radiology, toxicology, medicine, and risk assessment.
• Describing and documenting the food supply chain that is under assessment. Business process management and modeling methodology enriched with TACCP analysis would be beneficial [47].
• Assigning results. Each factor can be ranked against CARVER+Shock attributes to calculate a final score for that node. The scoring tables used for analysis are often calculated based on catastrophic accidents at a national level. The scoring can be modified in order to meet a specificity of a given facility. A key factor is that the analysis helps to distinguish one operation of the entity from another
• Applying the lessons learned. After critical factors have been identified, the final step is to develop a plan to implement countermeasures that minimize the attractiveness of targets. Remedies may include improvements to physical assets, personnel, and operational safety that help minimize aggressor accessibility to a process or product.

4. Empirical Results and Discussion

4.1. Business Process Management and Modeling Methodology

Business process management and business process modeling offer a variety of strategic and operational benefits, including better preparation for periods of rapid change and better ability to manage risks, including food fraud.

The process can be understood as including related activities to achieve a predetermined goal. That means converting the input into a pre-defined or specified customer value at the output. As the processes are not limited to a single organizational structure, their application to many organizations, sectors, and even countries is possible, including SMEs and government agencies [48].

Business process modeling was used here to visualize processes and risk analysis according to the methodology in

Table 4. CARVER+Shock criticality grading scales in the case of onion production. Source: [46].

	Process/Function/Stage		Product/Output
	Good practice/Policy		Consequence for enterprise
	Risk		Consequence for product
	Stakeholder (outsider)

. Within this methodology, further diagrams related to onion production were prepared, for example in the visual abstract.

4.2. The Studied Enterprise

The primary production enterprise that was studied has been operating since 2000. It is located in a village of approximately 2300 inhabitants in the Greater Poland Voivodeship. It is a small enterprise (number of employees from 10 to 49 people). The company’s leading activity is the cultivation of onions and their purchase from other primary production companies, followed by initial processing (machine removal of the skin) and sale of peeled onions for further processing purposes. Its clients include enterprises dealing with fish and meat processing, and producers of breaded fried onions. To meet customer requirements, ensure the appropriate quality and safety of the manufactured product, and stand out from the competition, the company implemented the Global GAP standard and obtained certification.

The enterprise has also tried to reduce energy consumption. The company accurately identifies and controls energy-intensive areas, determining which internal or external factors influence energy consumption. The company has conducted thermal modernization of buildings and attempted to recover heat from production equipment.

According to the company owners, the most important goals for the enterprise were generating profits, saving energy, saving resources and materials, training employees, and increasing the share of renewable sources in energy consumption (Figure 2).

4.3. Results and Discussion

Implementation of CARVER+Shock in the enterprise began with establishing assumptions regarding the scope of the planned assessment and identifying potential threats. The stages of the onion production process in the enterprise are presented in Figure 3 below.

Four stakeholders were identified as the primary source of a potential attack on an enterprise and a product: employees (current and former), the enterprise’s competition, the local community, and terrorist groups (Table 4). In addition, the analysis assumes that the perpetrator wants to cause maximum damage to the company, the environment, and society, so each time, the assessment considers the most dangerous of all possible events and the effects they cause.

CARVER+Shock was implemented by appointing a team of specialists who were given responsibility for the assessment. The most important members of the expert group included company representatives (representing the top management, line managers, and employees accountable for operational works), and experts in the field of food safety, and quality and risk management. In total, the team conducting the analysis consisted of nine people.

The first step was to select the most important stakeholders and evaluate them against threats they can cause. The threats also should be named and assigned to the proper production or distribution stage (

Table 5. Identification of potential attackers.

No	Attackers	A Possible Method of Attack Depends on the Target of the Attack
1
2
3
4

).

The evaluation results for CARVER+Shock are presented in

Table 6. CARVER+Shock assessment of the surveyed onion production enterprise.

Stages of the Basic OnionProduction Process	The Attribute and its Rank							Risk Indicator *
	C	A	R	V	E	R	Shock
1. Growing, harvesting, and transporting onions	3	10	7	10	10	10	1	51
2. Acceptance of raw materials, unloading, and storage	3	4	3	4	4	8	2	28
2.1. Shipments of onions from other suppliers
3. Basic processing (drying, sorting, peeling and washing, packing)	3	2	4	6	10	6	2	33
4. Cold storage	3	4	4	4	2	8	2	27
5. Packaging and distribution	3	8	2	9	1	10	2	35
Attribute (total)	15	28	20	33	21	42	9

* Ri = C + A + R + V + E + R + Shock Source: Own work based on the company’s information.

.

According to CARVER+Shock, the highest risk index was identified at the stage of growing, harvesting, and transporting onions (R = 51) (Table 6.), to which the following factors contributed:

• Criticality (3): the attribute ‘critical’ as a measure of public health in the attack relates to health problems or loss of life among workers and residents adjacent to the onion cultivation.
• Accessibility (10): access by unauthorized people is highly probable, e.g., temporary workers are hired for harvesting and transport.
• Recoverability (7): Growing onions is associated with a certain length of growing season, and in the case of chemical contamination, soil remediation can be a long process.
• Vulnerability (10): The evaluation team found that the cultivation, harvesting, and transport of onions favor the accessible introduction of a contaminant, while the environment is favorable because the cultivation is not monitored.
• Effect (10): The attack’s impact could destroy more than 50% of the production system; soil remediation, re-purchase of raw material, and disposal of contaminated raw material or product must also be considered.
• Recognizability (rank 10): The goal is straightforward to recognize. It is very easy to locate the onion fields and to identify company transport because they carry a company logo.
• Shock (rank 1): in this case there is no historical, cultural, religious, or other symbolic significance.

The other stages of onion production and their CARVER + Schock scores were:

• Packaging and distribution (R = 35)
• Basic processing (drying, sorting, peeling, washing, packing) (R = 33)
• Acceptance of raw materials, unloading, and storage (R = 28)
• Cold storage (R = 27).

The assessment of individual CARVER+Shock attributes was based on a detailed analysis of potential threats, with selected examples presented in Figure 4. Each letter from “A” to “F” in Figure 4 represented each stage of the production process. For the analyzed events, preventive actions were proposed, focusing on removing the causes of a possible non-compliance or other undesirable situation to prevent future occurrences.

It was proposed to develop a standard for the quality control of the raw material and soil at the growing, harvesting, and transport stage. First, the company should determine what and when should be controlled at this stage. Additionally, the company should increase vigilance when harvesting the onions, because it most often uses the services of temporary workers hired through an employment agency, i.e., the company has limited opportunity to verify employees and thus should reduce the risk associated with this form of employment.

Particular caution should be exercised in conflict situations which may occur between the enterprise and the local community. Their business activities disturb local residents due to the smell of onions; the company has already received petitions regarding this matter. The frustration of the local community could increase because the village where the company is located has been rapidly developed as a residential area in recent years. Thus, this aspect may be a potential cause of conflict. Of course, the company has taken steps to alleviate the situation. Notably, it engages in social activities carried out in the town, sponsors awards for children at the local school, etc.

The second and third critical stages are “acceptance of raw materials, unloading, and storage” and “shipment of onions from other suppliers.” Access for raw materials (unpeeled onion) from fields or other suppliers is through a different gate than delivery of the finished product (peeled onion). The appointed team conducted an observation and concluded that current monitoring does not cover the entire area of the enterprise. It has also been observed that the gate used by the unloading vehicles is not closed immediately, but remains open until the transport is unloaded and the delivery vehicle leaves. Such a situation may make it easier for people who want to harm a product or the business, so taking preventive actions in this area is justified. The company should introduce additional monitoring and close the gates immediately after the entry or departure of vehicles.

At the “primary processing process” stage, the main threat is employees who, for various reasons, may want to attack the product or the enterprise. Therefore, the management monitors situations that could escalate into conflict, and has established a code of ethics and work regulations. However, no recruitment procedure following the applicable legal standards has been developed to verify employees’ credentials. This requires establishing an interview process and taking other steps to verify the credibility of the information obtained.

The “cold storage” stage is prone to loss of refrigeration capacity, leading to spoilage of the product and creating a food safety hazard. A deliberate attack may target the company’s energy supply, which is crucial for food safety. The company should consider renting refrigerated trailers or external refrigerated warehouses, to provide a storage service in an emergency, and purchasing a power generator.

Additional area monitoring should be implemented at the “packaging and distribution” stage. The management should also set up guidelines and rules for transport to minimize the risk of an attack on food, such as prohibiting the load from being left unsupervised or introducing the sealing of trailers after loading.

Training and simulation of crises should be introduced, which will strengthen employees’ awareness and their involvement in the food defense process, following the Employees FIRST system [28]:

• F (Follow)—follow the established plan and food defense procedures.
• I (Inspect)—control your position, work area, and adjacent positions and areas.
• R (Recognize)—recognize what is wrong.
• S (Secure)—secure all ingredients, supplies, and finished products.
• T (Tell)—inform your superiors if you notice anything unusual or suspicious.

These suggestions can significantly strengthen food defense in the surveyed enterprise.

5. Conclusions

Food-producing companies constantly face threats that may harm product safety, affect the business activity of an entire organization, decrease its value, or cause a loss of brand reputation. The most crucial threat is deliberate contamination of crops or food with various chemical, biological, or other harmful substances, carried out by attackers who want to harm the enterprise and the local community.

Therefore, it is necessary to reduce the risk of this occurring. The CARVER+Shock approach described in the paper can help analyze threats and assess their risks. It can be used to determine the vulnerability of a system or infrastructure to attack, and it also allows identification of the most attractive targets for attack. By carrying out such a vulnerability assessment and identifying the most vulnerable points in an organization, resources can be focused on directly defending them.

The CARVER+Shock output and the interviews with the enterprise employees showed that thise onion producer is not fully prepared for food terrorism. The company did not have any procedures describing how to proceed during deliberate attacks. In addition, workers’ awareness of food defense throughout the food chain was low. The use of CARVER+Shock in the company contributed to development of a food defense strategy and increasing staffawareness of the risk. According to the authors’ knowledge, this was the first implementation of CARVER+Shock in the primary production process in Poland. Management should perform a CARVER+Shock diagnosis at specific times; the results presented in the paper could be used as a benchmark.

There were also some limitations related to the use of CARVER+Shock. The first concerns the case study as a scientific method, and the second relates to the CARVER+Shock classification by experts. The results are exposed to limited subjectivity, as they depend on the knowledge, beliefs, and attitudes of experts.

Summing up, the primary production company described in this paper showed a deficient level of preparation for potential threats, including:

• awareness and competence of executive employees and company managers
• standards and procedures ensuring the safety of the production system
• development and implementation of preventive measures relating to the company and entities in the supply chain
• observation and monitoring of preparations for potential attacks (monitoring of the plant, tracking information in the local press and social media).

The implementation of recommendations made in this paper is crucial to improve food safety in the primary production process, due to the increased expectations of supply chain entities and the growing awareness and requirements reported by consumers and the public.