Like any other US citizen, I have been paying attention to recent headlines about food. Recent press suggests something is out of whack. Reports in the media, from USA Today to consumer blogs, say the US food system is at risk. The US Government Accountability Office (GAO) calls federal oversight of food safety a national high-risk area because of risks to the economy and to public health and safety. In a recent report, the GAO stated that “the current fragmented federal system has caused inconsistent oversight, ineffective coordination, and inefficient use of resources,” recommending that Congress consider a reexamination of the entire food protection system “to help ensure the rapid detection of and response to any accidental or deliberate contamination of food before public health and safety is compromised.” In addition, recent publications by William Sperber, Ph.D., a highly experienced food safety scientist formerly with Pillsbury and now with Cargill, contends that the ability of a food business to execute a Hazard Analysis and Critical Control Points (HACCP) product safety system is being clouded by new and planned government regulations.

I have been blessed with some unique opportunities—working on the Apollo Project in its early days and being part of the creation and implementation of a product safety program during an exciting growth period of The Pillsbury Company. Surprisingly, these two experiences were connected. I believe the work done by so many at Pillsbury was a large contributor to improved food safety management both in business and government. However, I am deeply concerned that in the current climate we may forget what really makes a product safety system work and thus get seriously out of balance. This article is based on the product safety program developed at Pillsbury, my role in installing a systems approach to implement it, and its relevance to current food safety challenges. But my purpose is to stress the importance of placing decisions close to the site of action and having the right system in place to support these decisions, operated by the business responsible to get the job done.

Systematic Safety Success
Systems can be treacherous. Even defining one is complex. A simple definition might be that it is “an integrated (interlocking) set of elements that accomplish a defined objective.” A system is no better than its sensory organs, which is usually a combination of people and machines. People are the interface between the system and its boundaries, which in a food business are regulatory agencies, the consumer and new discoveries in science and technology. Good systems tend to last if they are maintained and not stressed too much.

A primary function of a for-profit business is the sale of products that make money. This requires that the products be safe. All organizations have operating systems, either created by design or simply occurring as a result of the flow of information required to make operating decisions. Major discontinuities can occur when there is a mismatch between a documented system and an operating system. Assuring safe products is a prerequisite for a consumer business’ survival, and it is fundamentally a “business problem.”

An important feature of product safety system design is its ownership. The people who use it own it. It is their job to maintain it and keep it current. It was and is a “people system,” with its primary purpose to manufacture safe products. Making our food system safe is a lot more complicated than going to the moon, but we learned much from the space program. It is said there were nearly 1,000 contractors working to send a man to the moon. As an industry, we can manage the interfaces necessary to produce safe products.

Every organization has operating units. These units have specific functions, required tasks to perform these functions, and specific activities to complete the tasks (in a second-to-second time frame just like a space mission). The most effective decisions are made closest to the point of action. The timely flow of critical information between operating units is what makes a system work. Of course, the larger the system is, the greater the probability of unexpected failure. Large systems increasingly lose touch with their surroundings and failures in internal functions frequently occur resulting in a loss of response time or no response at all. Smaller loose systems, flexible and adaptable like life itself, last longer and work better.

The food industry has had good systems for years. We learned how to create it and make it function years ago, and in most companies it still works. We know that the organization with the greatest incentive and capability to produce a safe food product is the organization producing it. But getting the job done requires people who know what to do and people who know how to do it, with the accountability to get the work done.

Too often there is a tendency to assume that because the science and technology is documented and government regulations are in place, that the work is done, when in fact it has just begun. It won’t work to try to improve “decision making closest to the point of action” by building bigger or more complex systems. What is needed are systems tailored to get the job done for a specific business and application. Too much data and information is the bane of operating systems. And today, data and information are available as they have never been before. If you did a search for food safety risks in any of the food system components shown in Figure 1 you would find hundreds of results in minutes for each of these components of the food system.

I doubt there is a food scientist in the world that has not heard of Hazard Analysis and Critical Control Points (HACCP), which is now an international institution. But we run the risk of losing sight of the second half of the problem “having people who know how to do the job, with the accountability to get the work done.” This means tailoring manageably sized systems to specific areas of application.

What We Know Already: A Good Foundation
Today food companies need new initiatives to demonstrate their ability to produce safe products and keep public confidence. There are new elements to consider, but we need to look at new issues through the lens of what we know.

1. New companies don’t know the system or established companies veer off-track. In today’s world, the $3.4 billion Pillsbury of the past was not a big company. A casual perusal of Forbes’ International List shows more than 20 food companies with over $5 billion in annual sales. A dozen or more of these have sales of over $12 billion a year. Most of these companies are multinational. The known brand names are only rarely associated with a public recall. They have the staff, management and systems in place to produce safe quality products. Still, they do have food safety problems. ConAgra, a $12 billion dollar company, recently had a problem in a plant resulting in Salmonella in peanut butter, which the FDA identified as originating in their Sylvestor, GA plant. It was attributable to moisture from a leaky roof and a faulty sprinkler system, causing a salmonellosis outbreak that sickened at least 425 people from 44 states. This is just one example of the fact that an established multinational company with an excellent safety record can get off track.

Another example: Today, fresh produce is much more likely to be moved in large volumes from the field to the plate than occurred in the past. Dole Food Co., now a private entity with sales over $5 billion, is the world’s largest producer of fresh fruit and vegetables. It has an excellent safety and quality record. A recall of contaminated spinach resulting in 199 cases of illness due to E. coli O157:H7 infection was reported to the Center for Disease Control, including 31 cases of hemolytic uremic syndrome, 102 hospitalizations and three deaths. Dole was implicated because some of the spinach had been packaged under a Dole label. Dole supported the recall but identified it as being due to a supplier, Natural Selection Foods. These smaller companies have had to deal with the threat of E. coli O157:H7 in lettuce and spinach, responsible for major recalls in 2006. The organic firm at the center of the spinach-related outbreak, Natural Selection Foods, is a holding company based in San Juan Bautista, CA, known for its Earthbound Farm and other brands. Earthbound Farm is now pushing for new federal rules for mandatory testing and congressional hearings question the food system in total. A better solution would be installing the right system in Earthbound Farms operations. The FDA has issued their findings on the 2006 spinach outbreak stating that the precise means by which the bacteria spread to the spinach remains unknown.

2. More foreign suppliers and globalization of the food supply chain. The recalls of foods tainted by wheat gluten from China containing melamine highlights the worldwide interconnectedness of today’s food system and the new risks associated with this.

3. Terrorism. We are faced with a unique twenty-first century threat: the possibility of deliberate contamination of our food supply by terrorists. Homeland Security, other federal agencies and universities are now analyzing the risk of terrorist attacks on the food components shown in Figure 1. The Sholl Group II, producing product under the Green Giant Fresh label, has taken concern for safety, both from accidental or intentional causes to a whole new level. The owner and his associates have started BT Safety and have developed exceptional computer programs for analyzing potential risks and the geographic and population pattern of risk as a function of time should that particular hazard occur. Their software systems deal with consequences, containment, and remedies of the hazard. Programs like this can provide both small and large companies with the ability to analyze and reduce risks associated with both unintentional and intentional food safety risks.

In all these developments there are tremendous capabilities for assessing, analyzing and defining critical elements. Figuring out what to do under different risk scenarios is doable.

4. Demands for a super-government agency. The job of a product safety system is to produce safe products. If it is working it prevents the hazard from occurring. Big, cumbersome self-protecting systems can’t do this. A super-government agency is not the answer. Big government can’t manage local problems. To those within a large system, outside reality tends to pale and disappear.

Take a little time to look at the organizations reporting directly to the President of the United States. Look at their organization charts. The FDA and Centers for Disease Control and Prevention (CDC) report to the Department of Health and Human Services, with a proposed FY2008 budget of $698 billion dollars of which the FDA is $2.1 billion and CDC is $5.8 billion. The USDA has an $89 billion dollar F2008 budget and the EPA has a proposed budget of $7.2 billion. Abraham Lincoln founded the USDA in 1862. The FDA was founded in 1906, following an inspection of a Chicago stockyard authorized by President Theodore Roosevelt and the publication of Upton Sinclair’s book “The Jungle.” The EPA was founded in 1970 following publication of Rachel Carson’s book the “Silent Spring.” The Consumer Product Safety Commission (CPSC) was founded in 1972. FEMA started in 1803, but was merged with the Department of Homeland Security (DHS) in 2003. DHS was formed in March 2003, uniting 22 other government agencies. Once a major government agency is established it doesn’t go away. Like every organization it protects its territory and constituents, and resists outside influences.

The “bell ringer” for the nation is the afflicted consumer or individual and the public outcry raised by media and books. From the country’s beginning we have all expected the government to be responsible for defense and peacekeeping, resource allocation, maintaining public goods and preserving externalities (e.g., environments) of health, safety and welfare. It has an obligation to us as citizens to do so.

5. Is our food really safe? The CDC estimates about 5,000 people each year die of foodborne illnesses. And about 100,000 people each year die from adverse reactions to prescribed medications. As individuals and organizations we respond most to overt unexpected threats—events where we did not expect the risk to occur. A sudden bridge collapse is a major disaster, but annual deaths of 100,000 due to alcohol, or 790,000 due to automobile accidents, don’t make headlines.

Even in light of the above challenges, food industry product safety risks are manageable—but not by a giant organization installing a massive system. The larger the system, the greater the probability of failure. Complex systems tend to produce complex responses, not solutions to problems. I urge all food industry executives to reexamine their food safety programs. The key points to revisit are:

• Management commitment to safe products (i.e., make it a policy).

• Know what to do (i.e., have the right scientific/technical input).

• Responsibility to act must be closest to the point of action (i.e., decentralized organization).

• The business unit is the responsible organization (just as in daily life you are accountable for your behavior).

• Keep the system simple, flexible and real-world operational.

• The system must be integrated. All elements need to relate to key people and the realities of the external environment in which you are operating.

• The culture of the company and business unit must support the system. Lack of trust or an “us against them” mentality destroys system function.

• Communications must be open at all levels within the business unit, at regulatory interfaces, and between those who specialize in understanding the risk and those responsible for managing it.

A good system pays for itself by assuring product quality, reducing losses and preventing recalls. You don’t need bigger organizations and big systems. You need to keep information interfaces between organizations clear enough so that working together gets the job done. Today’s potential for instant communications, use of sophisticated sensors, and aware and informed people with the ability and authority to react, sets the stage for the food safety system that becomes a business imperative. The consumer has every right to expect that each product of yours that they eat will be safe.

Implementing the Pillsbury Product Safety Program
I joined Honeywell in 1962 and was deeply involved with Apollo Manual Control Design and Function, for which Honeywell was a prime contractor. My first assignment was to analyze John Glenn’s Gemini suborbital mission. Every 30 seconds had to be broken down into what he did, why he did it, and what was the outcome (something I learned would have many applications for me in the future). When the Apollo design phase wound down I joined the Honeywell Systems and Research Division working on Lunar Surface Vehicle simulations, both as a subject and as a project director. What really stood out for me was the ability of nearly 1,000 contractors to build an integrated system with only one objective: to put a man on the moon.

Our objectives in Lunar Surface studies were to simulate a minimum volume lunar mobile laboratory, one of several concepts NASA was evaluating for manned lunar surface exploration. In 1966 I was a project scientist/manager for an 18-day simulation with two NASA space center engineers as subjects. A safe and nutritious food supply was a mission critical factor in these studies, and for all manned space programs. The Pillsbury Company provided the vacuum packed dehydrated food used in our lunar simulation studies. It was during the course of these studies that I met Dr. Howard Bauman, then-vice president of science and technology for Pillsbury.

Pillsbury had NASA contracts to develop food for Mercury, Gemini and Apollo space missions and had adapted an approach involving the analyses of potential hazards and the necessary critical controls to assure that these hazards did not occur. A number of organizations were working on similar projects since 1959 in the Army’s Natick Labs and in NASA with applications to both Gemini and Apollo food supplies. Pillsbury, however, had the contacts with NASA that resulted in the HACCP program. They had been working to convert these concepts to measuring sticks for Pillsbury Corporate R&D’s scientific and technical performance and had formed an ad hoc product safety committee to interface with other corporate functions and Pillsbury’s family of businesses. Howard’s concern was that though they had come a long way in learning how to specify safe products, there were still operating problems in the businesses.

At this point in Pillsbury’s evolution, the company was managed by a mix of centralized corporate staff and decentralized free standing businesses (FSB). Each FSB was headed by a general manager reporting to the executive office, then consisting of Robert (Bob) Keith, CEO, with a sales background, and Terrance (Terry) Hanold, president, who came up the ranks of corporate staff. At that time (1972) Pillsbury was about a $670 million dollar business with the FSBs made up of Agribusiness (flour and grain merchandising), Grocery Products (dry mix), Refrigerated Foods (dough), Poultry & Food Services, and Burger King (acquired in 1967). The organization was complex and evolving.

Early in our discussions, Howard introduced me to Terry, a very thoughtful, proactive person. Corporate R&D and Information Systems reported to Terry. There was tension between Corporate and FSB roles, which meant problems in the information flow from corporate to the business resulting in products being out of spec and operations failing to incorporate hazard analyses. I saw this as a systems integration opportunity, with the singular system objective to make safe products. I assumed a simple feedback system where Marketing and R&D created products designs, R&D specified the product, and business plant operations produced the product.

More specifically, the interplay between scientific information, industry standards, government regulations, product development and manufacturing, and data auditing involves multiple feedback loops (Figure 2). Both industry and government depend upon correct short- and long-term scientific and technical information to be aware of the hazards to avoid in order to ensure safe products. In industry, ideally, this information results in rules (or policies) that are translated into specifications and documented procedures that guide and constrain manufacturing operations that produce the food we eat. This is especially important for food additives and ingredients, but in practice, it can often be unclear. Similarly, government agencies establish regulatory standards within which industry must operate. There is usually an elaborate paper system in place to document the structure of organizational behavior, from organization charts to job descriptions. But that is not the system that works. The paper system can lag an operating system by months and even years.

If the system works, the product should reflect its design, including all safety and quality requirements. But any system depends on the people who design it, run it, test it and correct it. Everyone has to be on the same page for the system to work. The analysis of potential hazards and critical control points had to be the joint responsibility of R&D and Operations, but at that stage in Pillsbury it appeared to be largely an R&D exercise. While several organizations (e.g., NASA, Army) had also begun to systematically identify food hazards and the means to control them, the HACCP acronym originated in Pillsbury. In 1971 FDA contracted to Pillsbury to provide a training course for FDA staff where the large blue book containing the individual lectures of Pillsbury staff was labeled HACCP. From my point of view, it was clear that Pillsbury R&D was exceptionally skilled in this area and I could be certain that people with the right academic background, skills, and relevant experience were employed to conduct analyses.

I entered into a one-year consulting agreement with Pillsbury in June 1972 to establish what I called the Product Control & Identification System (PCIS). My contract went beyond product safety (including human safety, energy and environmental safety). It required that I consult with respect to: 1) the conception and design of information systems associated with product safety and product excellence; 2) the installation, testing and evaluation of such systems; and 3) the type and extent of interaction between the various operational and staff functions of Pillsbury necessary to produce maximum value from the information systems installed or proposed to be installed. I asked for a small team of senior Pillsbury staff (initially four people) to be assigned to the PCIS task force. Our initial thrust was to break the work into system phases. Phase I would entail uniform specifications capable of being automated, and Phase II would be a cost/benefit pilot study in a refrigerated foods plant, including the necessary information content and actions to make the system operational. It was clear to me that Howard Bauman knew how the system ought to be and Bill Powell (Pillsbury V.P. Law and my boss) knew that the system ought to be. My job then was to see if we could create it and put it in place so that it would actually work throughout the company. It is a pleasure to now see Howard’s critical role in HACCP development formally recognized by USDA senior officials by creating the Howard E. Bauman Award.

I knew that a prerequisite for this to work would be the buy-in of all key executives. A series of incidents in Pillsbury plants had convinced chairman and CEO Bob Keith that product safety must be a number one priority. I don’t think Bob needed prompting to make food safety a number one priority; he just needed to be informed of problems needing fixing, and he needed a working system to do this. The story in these early days was that Keith was marching in a new direction and the rest of the company hadn’t got the message yet. So, I had a top management mandate, but I would have to gain the commitment and trust of each of the key operations executives. To do this the system would need to be vital and economically productive. Pillsbury executives were an exceptionally responsible group of men with great integrity. They all were committed to safe products. Their challenge to me was straightforward: Show us how it will work and what it will do for us.

Our PCIS task force had to get up to date on what was currently in place, how it works and how it would fit in an operating system. How were products specified, how did these instructions get translated into plant actions, and how was it determined that the produced product met the specifications? The PCIS task force could access the systems in Corporate R&D, but we needed to work with actual operations. The East Greenville, PA, refrigerated plant was selected to be our test plant. Why? The integration of product information, from R&D specifications to plant production output at the test plant was not working well. Once a specification was completed it was not a simple thing for a plant to adhere to it. The specifications were written in a language that did not conform to plant requirements for timed large volume throughput, scoops and shovels full of special ingredients at key times, and varying plant operating characteristics as plant line managers adopted different assembly lines to different products. Working with plant staff and management and headquarters and corporate staff resulted in a working specification we called a Plant Operating Formula. But there were other issues symptomatic of issues of concern throughout the company. This plant study served as an extremely vital model of what needed to be done, as illustrated in the case study of a specific product safety system failure and its remedies. (See Case Study below)

Plant managers were incredible assets in their input to the early system design. Once we had a clear understanding of the required information needed by the plant and the benefit of really understanding an experience like that described in the case study that showed what we really needed to do, the design became clear.

Pillsbury had all the elements in place for a food safety system, but they weren’t integrated and lacked certain key human elements and connections with its external environment. And when an organization’s operating system is defended by the phrase, “This is the way we do it around here,” you can be sure you are dealing with a cultural issue. There were distinct cultures within Pillsbury that often did not allow integration of key information. Each FSB had there own operating culture. So when we sought to integrate specifications in the consumer foods businesses, Grocery and Refrigerated, we found that they used different language and terms. Before specifications could be automated we had to come to agreement on these differences, requiring many meetings between R&D staff, business headquarters staff and Corporate Information Systems staff.

We needed communications between those skilled in interfacing with state and federal agencies and staff performing hazard analyses such that mutually agreed upon conclusions could be achieved, frequently involving R&D scientists, engineering, legal, and quality assurance staff. What does “safe” mean? Is it an absolute or statistical outcome? How should we interpret the Delaney Clause that required zero tolerance of a carcinogen? Many ingredients are acceptable within tolerances established by regulatory agencies. Is there a difference between saying something is safe versus “safe for all practical purposes.” Can we control infestation of spices with radiation? How do we ensure that the assurance of a package supplier was adequate to protect against PCBs? What tests do we need to do on incoming ingredients and packaging materials? But there was agreement on our general objective: safe products. These meetings did occur, and differences did get resolved.

Each plant had its own unique environment. Plants were of different age and construction. It was necessary to conduct a physical hazard analysis specific to each plant that took into account lighting shields, locations of sifters and screens, amount of dust and associated airflow, etc. Each plant and operating facility had critical control points unique to its facility and production schedules. Each plant and facility is also a hub for enormous quantities of transported goods, by truck and rail. Storage facilities are utilized both for incoming ingredients and finished products with there own unique requirements. In each case there are time and temperature considerations and the need for pest control.

This time-sensitive flow of material, from ingredient and packaging components to finished product—tested, sifted, screened, moved, stored—is accompanied by related information necessary to access safety, quality and throughput. The associated monitoring and checks allow constant management surveillance, and constitute a relevant audit trial.

Tracking product codes, shipping vehicles and dates, become critical components for recall systems, always necessary to safeguard consumers from unexpected breakdowns in the system (and in those days, I was very concerned about recalls). Monitoring consumer correspondence for complaints and bouquets lets you take the pulse of the consumer and target specific responses as needed.

But none of these elements would work in an integrated way without management commitment and a “bell ringer” culture. It had been common practice that if a line operator in the plant encountered a problem he needed to contact the shift supervisor, who would contact plant management, who would in turn contact an operations manager at headquarters. The line may or may not be shut down, depending on the incident. With the new clarity of information as to what constituted a critical control point, any employee encountering a failure at any point could shut that line down. This required more informed employees (i.e., an investment in training), but with quick response those costs could be recovered by reduced shrink and recall prevention.

By the start of 1973, the Pillsbury Product Safety System was defined, an automated specifications system was underway and the East Greenville plant study had resulted in an integrated safety system for refrigerated foods that helped solidify the elements of a product safety system that could be used corporate-wide. We could also use this as a guide for approving our suppliers. There were 10 interlocking elements in this early PCIS (with Steps 1 and 10 the real drivers of the system):

1. Total commitment of management.

2. Product specifications, including ingredient and packaging specifications (an R&D job).

3. Hazard analysis and the identification of critical control points (an iterative process in the creation of final product specifications, requiring the skills of scientists with diverse but applicable backgrounds such as microbiology, chemistry and other food science specialties, in participation with operational engineers.)

4. Plant operating formulas (i.e., converting R&D specs information to plant operations action items, requiring close communication between R&D and plant staff to assure that HACCP and quality elements specified can be realistically achieved in the plant).

5. Physical systems hazard and control system (requiring frequent physical inspection of the plant facilities and the equipment necessary to protect the ingredients and product).

6. Transportation/storage (requiring rail car and truck certification and inspections of all warehouse facilities to assure safety from pests and contamination).

7. Monitoring and checkpoints (i.e., ongoing checks, records of action taken and a complete audit trail).

8. Recall systems (requiring product codes, dates and automated tracking).

9. Consumer complaint monitoring.

10. A bell-ringer culture (i.e., everybody buys in and anyone has the authority and absolute requirement to stop everything at the point of hazard detection). Everybody in the company has to believe it, say it, and do it, from the CEO to the plant sweeper.

The PCIS System was adapted and installed in Pillsbury’s food and non-food business. Pillsbury’s decision to make safety a priority had many benefits. Product Safety’s impact on specification design and implementation meant improved quality assurance. Avoiding risks of recall and adverse consumer responses meant significant cost avoidance. Integration with computer systems meant improved material control, and reduced shrink. Focusing on effective and efficient use of information lead to better accounting and cost control.

With rapid growth of the company and the emphasis on decentralization, I increasingly focused on making sure people were in place to make the system truly owned and operated by the business unit. By 1983 Pillsbury was a $3.4 billion dollar company and I was confident in the systems installed in our businesses and the people committed to make them work. A NASA report on impacts of the space program on food safety stated that there were over 130 food safety recalls between 1983 and 1991—none were Pillsbury products.

John E. Haaland, Ph.D., Chief Science Officer and Chairman of The Rown Group, Inc., a company engaged in commercializing microelectronic devices for remote physiological monitoring. He is also a member of The Blue Circle Group, engaged in risk management and product safety. Early in his career, Haaland was a Principal Research Scientist for Honeywell, Inc., where he was a member of the Apollo Project Human Factors Group. Later, he was a Research Associate in the Department of Genetics and Cell Biology at the University of Minnesota, and Vice President of Research and Development at Health Service Systems. Haaland was a Corporate Vice President of The Pillsbury Company and a member of its Senior Management and Venture Committees from 1973 through 1983. Haaland created the Pillsbury Product Safety System (consisting of Pillsbury’s Product Control & Identification System, incorporating HACCP) and implemented it in all of Pillsbury’s businesses and suppliers. He received a Ph.D. in biophysics from the University of Minnesota, completed the Stanford Executive Program and holds three patents. He can be reached at johnhaaland@comcast.net.
 

A Case Study of Product Safety Failure and Remedy
If you ask any CEO or senior manager or plant manager of any company if they are producing products that could injure or kill their consumer they will vehemently deny it. Companies don’t deliberately produce products that kill their customers. To make this concrete, let’s look at a specific example in Pillsbury that occurred years ago. Let’s look at five elements: the product, the producing plant, production management, general management, and the government. The product, in this example, is a biscuit. Its refrigerated dough process was invented by Ballard, a company bought by The Pillsbury Company, and was a breakthrough in dough technology. Its R&D specification called for a formulation to meet consumer expectations and was substantiated by taste tests. Its formulation assures, that if produced and packaged in accordance with this specification, it will meet or exceed consumer acceptance criteria. And it does. It is a popular and profitable product. Its advertising image became a nationally known symbol.

The product, though simple, when produced in large volumes is complex. It could be subject to several errors in production that could change its state from the product specified and meeting consumer expectations, to one with far less desirable outcomes. A misformulation error at the plant could result in an undesirable or hazardous level of microbes or chemicals in the product, or even excessive pressure in the can. An accident in the plant could result in foreign material, like glass or wire, getting into the product. Any one of these probabilities is unlikely, and is certainly not intended.
The plant, in this example, is operating to meet specific production quotas. Each product line worker, line supervisor, plant quality assurance (QA) manager and plant manager knows what these production quotas are. If a problem occurs, the line worker tells his supervisor, who tells his plant manager (and informs QA), who tells his business unit general manager, who may or may not tell the company CEO. Problems are not detected until after the event occurs, so time is a critical parameter.

On this particular day, a plant inspector tells his supervisor, that following his weekly inspection routine he has discovered a broken sifter screen on one of the flour lines. Flour is a major ingredient of the product. The supervisor is behind in his quota, but informs the plant manager shortly thereafter of the problem. The plant manager is behind also, and after a while, informs the Vice President of Production, who lives 1,000 miles away, of the problem. His first question is “has the product already been shipped?” Yes it has. He then informs the general manager, who is then quite unhappy. One week later, a consumer bites into a biscuit and drives a piece of wire into her gums. She immediately calls the store that sold her the product and demands her money back. The grocery store fills out a complaint form and notifies the producing company, and, in this case, the irate customer calls the company, using the phone number on the package.

A lady who is extremely good at dealing with irate customers (and making refunds or providing free products as needed) answers the phone. She asks for a number of specifics about the case, since it is common for people to fabricate stories in order to get money back or free product. She also asks for the product package and the piece of metal discovered in it. Her associate in the customer complaint department had just learned of the sifter break in the plant from the Production VP. He flies out to see the consumer and pick up the samples immediately, confirming that it is from the suspect plant, and is sifter screen wire. By now a large number of consumers in diverse areas are eating wire in biscuits, and the local health officials are notified. These officials notify the FDA, who notifies the CEO of the company, who is now very unhappy.

This was not an uncommon experience. In fact, it had occurred a sufficient number of times in the company, that the FDA threatened to bring TV reporters with them to lodge a formal action against the CEO at his home. A major product recall was underway, plant people were being reprimanded and fired, and the incident was managed. But the problems were not solved.

At each operating level, there were procedures in place should an accident like this occur. A sifter cell wire incident, in isolation, was not a great concern. But by the time it was found that a large part of the screen had broken, and the wire fragments were widely distributed, the product had already been shipped. The triggering of each decision point up the line did not reach crises proportions until an outside regulatory agency was informed, then the organization was fully mobilized, but too late. Fortunately the customers consuming the product did not suffer any serious injury. Profits and sales were exceptional that year.

The organization’s reaction threshold was set so high that by the time the managers could react (switch to an emergency operating mode), the reaction had cascaded. A recall was underway and a regulatory agency had become the initiator of a total company response.

This was not an isolated kind of event, or one involving only Pillsbury in the early 1970s. Across the US, this outcome was so common across so many categories of risk that several new federal agencies were created for safety— the CPSC; in the human safety area, OSHA; and in the environmental area, the EPA. The government asserted preemptive control in response to a perceived threat to consumers.

In the example given, the problem was corrected by the design and implementation of a system. The system encompassed all known risks in components, product design, in-plant production, safety inspections, regulatory affairs, consumer response, and crises communications and recall procedures. It required metal detectors in all plants and all light fixtures to be guarded. But the most significant requirement was a change in behavior. This was going to go far beyond technology and specs. It was going to require a change in the culture of the company.

In this business unit, people were good. They cared about their work, were very responsible and intelligent. The major operating change was that if anybody came across a safety incident, potential or in progress, they had the authority and absolute requirement to stop everything. The line or plant would shut down and the problem would be fixed. It became known as the “bell ringing” requirement. Now, when safety information was encountered the action occurred at the site immediately, and the process of deciding what to do next could be evaluated by relevant managers according to the degree of risk while the product was being held. The process of communication took minutes, not days.

But what would make a person make the correct judgment? Could line workers be trusted? If the criteria for a safety incident remained simply a legal and regulatory requirement and responses were based on statistical probabilities with traditional cost/benefit analyses, the system would fail. It would be okay for lines of thought such as: “It was only one piece of metal, what is the likelihood that a consumer will eat it? It was small, if they didn’t bite into it they’ll simply pass it through in their feces.” Or, “Anyway, the government has allowable levels of microbes, rodent pellets and hair, why not allowable levels of glass and metal? If we avoid the recall, the dollar risk is low.” This kind of discussion becomes an analytical and regulatory one that, as in all legal matters, becomes a matter of due process. It would not inspire the line operator, nor convince him that his bell-ringing action was truly endorsed by management.
It had to become an ethical issue. Each employee simply had to believe and commit to the absolute requirements that our products will be safe, and that no consumer would be injured by the use of our products when used in accordance with our preparation instructions. Everybody in the company had to believe it, say it, and do it—from the CEO to the plant sweeper. The ethics of caring and commitment had to be translated into specific action if anything occurred that triggered it. And it worked. After three years of system installation, employee communications and real-time rapid response situations the commitment was demonstrated at all levels.

Communicating detailed guidelines are always subject to interpretation. But communicating that everybody cares and everybody has the authority to act on what is right is communicating a shared value system that makes you proud of yourself and your company. Most of the people who worked to make this system a reality in Pillsbury are retired, deceased or employed by other organizations. But when I checked a few years ago, the system was still in place.

—John E. Haaland, Ph.D.