Introduction

In today’s globalized world the number of risks in supply chains are increasing, and the threats are becoming more complex. All the risks and threats can have a severely negative impact on markets. For this reason, it is necessary to have controlled conditions and preventive measures that guarantee that international commerce operations are carried out safely. Such measures help protecting against being the target of criminal activities like drug-trafficking, patent violations and terrorism (^{Rao and Goldsby, 2009}; ^{Kleindorfer and Saad, 2005}; ^{Kleindorfer and Van Wassenhove, 2004})

Since the terrorist attacks of 2001, there has been greater emphasis on supply chain security. The United States was the first country to adopt and promulgate new heightened security laws due to the terrorist attacks. The United States Customs Agency began enforcing the Container Security Initiative (CSI) in the beginning of 2002. The Customs-Trade Partnership Against Terrorism (C-TPAT) was also founded in 2002. Today many countries are working in order to have a global framework to ensure that their supply chains are safe (^{Closs and Mcgarell, 2004}; ^{C-TPAT, 2014}; ^{FDA, 2014}).

In this context, terrorist attacks on water and food supply is a risk that must be controlled. The food supply chain represents an attractive infrastructure that serves as a target for terrorist attacks. In order to have an idea of the magnitude of the food sector consider this: only in the United States, consumers spend more than $617 billion a year on food, of which $511 billion are spent on food within the agriculture sector (^{DHHS, 2005}).

Food terrorism has been defined by the World Health Organization as "an act or threat of deliberate contamination of food for human consumption with chemical, physical or microbiological agents for the purpose of causing injury or death to civilian populations and/or disrupting social, economic or political stability" (^{WHO, 2008}).

In contrast to the risk of food terrorism, the concept food defense has emerged. It covers the mechanisms for the analysis of food terrorism risks and the improvement in the prevention of these attacks. Thus, it refers to Risk Management. It is different from food safety as it involves intentional contamination instead of accidental contamination.

Food defense is an increasingly important topic to governments of different countries, as can be seen in various agreements, laws and standards. Among the most important are: Food Safety Modernization Act (FSMA), Customs-Trade Partnership Against Terrorism (C-TPAT), ISO/TS 22002-1: 2009, PAS 96:2014 and SQF Code 7.2 Ed. (^{ISO, 2009}; ^{BSI, 2014}; ^{C-TPAT, 2014}; ^{FDA, 2014}; ^{SQFI, 2014}).

Hence, the food supply chain must ensure that its activities follow a defensive approach, so the risks are as low as possible. This need for protection must be addressed from different points of view. One of the most important standpoints is related to the adaptation of the business processes and organizational structures that are involved in food exchange and handling.

The business process approach has gained importance in companies since the 90s compared to the traditional hierarchical departmental point of view (^{Aguilar-Savén, 2004}). Some examples of business processes are revised in (^{Kettinger et al. 1997}; ^{Swanson, 2003}; ^{Gaitanides, 2007}; ^{Damij et al. 2008}; ^{Vanderhaeghen et al. 2010}; ^{Skrinjar and Trkman, 2013}; ^{Rogge-Solti and Weske, 2015}; ^{Ruiz, et al. 2015} and ^{Zhu et al. 2015}). The process approach consists of compiling the enterprise activities in a logical sequence, thereby creating a clearer vision of the company’s activities. One objective is to attain better understanding, control and productivity in the activities that generate value to the enterprises.

The government of the United States of America has developed two entities: the ORM (Operational Risk Management) and CARVER+shock for the analysis of Food Defense, following a traditional hierarchical departmental approach (^{DD, 2000}; ^{FAA, 2000}; ^{DHHS, 2001}; ^{Rasco y Bledsoe, 2007}; ^{Kleter y Marvin, 2009}; ^{Rasco y Bledsoe, 2010}). The business process approach would enable the integration of prevention, control and protection mechanisms to face food terrorism in the activities of food supply. Thus, this approach would be a clear and decisive contribution to Food Defense in an enterprise or in its FSC.

However, despite the obvious benefit offered by the business process approach in the field of Food Defense, the consulted literature ignores the business processes point of view and offers a partial understanding of the vulnerability in each link of the FSC. The development of a Key Performance Indicator (KPI) to measure Food Defense in business processes in order to establish its performance with regard to prevention and protection from intentional contamination has not been considered in studies about Food Defense.

This paper proposes a procedure to create a KPI that measures Food Defense in business processes. Thus, it provides a metric to establish if each link of the FSC attains its objectives and strategies with regard to Food Defense, according to the appropriate standards considered by the food industry. The measurement is carried out according to proven scientific methodologies in other areas of Risk Management, for instance those related to industrial safety or food safety. In order to verify the validity and practical viability of the proposed indicator, it is applied in a Mexican food company, in El Bajío area, and its three-link supply chain (supplier-manufacturer-customer)¹.

Literature Review

The supply chain security is defined as the application of policies, procedures and technology in order to protect the supply chains goods from theft, damage or terrorism and to prevent the introduction of unauthorized contraband, people or weapons of mass destruction along the entire supply chain. As a way of referring to this multitude of actors and fields of action, the term Supply Chain Security Management (SCSM) was coined (^{Bowersox et al. 2007}). Subsequently, ^{Hintsa et al. (2009)} indicates that each measure of SCSM should orient itself to preventing, detecting and recovering from a delinquent act as fast as possible.

For the World Health Organization, food terrorism has become one of the biggest global public health threats in the 21st Century. It expresses concerns about the possibility that physical, chemical or biological agents might deliberately be used to harm civilian populations. In this regard, food is recognized as a potential vehicle for disseminating such agents to a broad population (^{WHO, 2008}).

Food terrorism aimed at food supply chains could have extreme economic and psychological consequences, for example the loss of human lives, economic problems and negative impacts on consumers’ trust (^{Onyango et al. 2005}). The deliberate contamination of the food supply chain could have a devastating impact in public health and in the global economy (^{DHHS, 2005}; ^{Stinson, et al., 2008}; ^{Degeneffe, et al., 2009}; ^{Alpas and Cirakoglu, 2010}; ^{Eggers, et al., 2011}; ^{Veiga, 2011}; ^{FDA, 2012}; ^{McEntire and Boateng, 2012}; ^{Parker, 2013}; ^{Barras and Greub, 2014}; ^{Mitenius et al., 2014}).

^{Brummer (2003)} considers the following consequences: (i) physical consequences: inedible food and/or insufficient food, with direct results could include significant morbidity and mortality or the indirect results of hunger and inadequate nutrition of the affected populations; (ii) psychological consequences: these problems could be present in the behavior of the consumers, which could include the perception of an unsafe and vulnerable food supply chain; (iii) political consequences, that could include civil discord and diminished confidence in the government; (iv) an economic impact that could be of variable duration with the confidence of the consumer lost and the market image of the companies involved.

Some studies concentrate on possible consequences of food terrorist attacks through diverse estimates, e.g. ^{Wein and Liu (2005)}, or response simulation models in cases of terrorist activity in food supply, e.g. ^{Hartnett et al. (2009)}.

In the food supply chain some links are more vulnerable than others. Consequences of the contamination could vary according to the type of food and the specific link in the chain that is targeted (^{Alvarez et al. 2010}). An attack that targets a step closer to the consumer has a greater probability of success but affects fewer people. On the other hand, an attack in the early steps of the supply chain affects many more people, but it has to evade many controls and countermeasures to be successful. The OMS indicates that the potential of intentional contamination of products is probably greater near distribution points, and the potential of mortality becomes greater the closer the agent is introduced to the point of consumption (^{WHO, 2008}; ^{FDA, 2012}).

Nevertheless, it does not happen when the products are consumed fresh as in the agricultural industry. ^{Crutchley et al. (2007)} indicates that the agricultural infrastructure is, due to its characteristics, extremely vulnerable to a terrorist attack, so it needs special attention. For ^{Monke (2004)}, the farm is the most vulnerable link and prone to food terrorism (agro-terrorism), because of its large land expansion, little surveillance, and bulk storage.

^{Setola and de Maggio (2009)} believes that when the contaminant agent is dispersed in the first links of the food supply chain, it becomes more difficult to identify and to detect the source of the contamination. Specially with chemical agents that when mixed can be imperceptible to quality control (^{Alvarez et al. 2010})

Also, the transportation and storage steps are, in general, more vulnerable that the manufacturing step (^{Alvarez et al. 2010}). Packaged products are more susceptible to contamination during transportation and storage. However, contamination of bulk products would affect more people (^{Alvarez et al. 2010})

^{Dalziel (2009)} has conducted a systematic examination of incidents involving the intentional and malicious contamination of food from 1950 to 2008. The analysis reveals that almost 98% of the incidents occurred downstream in the food supply chain (e.g., at retail outlets, food service establishments, homes and the workplace). Typically, the incidents involved commonly-available household, agricultural or industrial chemicals. When more esoteric chemicals were used, the perpetrators often had access to these agents at work and also possessed the knowledge to use them. Incidents involving biological or radiological agents typically occurred at the retailer or at the consumer and had little impact on public health.

Preventive tools have been developed due to the complexity of terrorist activities and their potential effects on food supply. One of these tools is the ORM that originated in the United States Defense Department as a system for operational risk management to improve security in military installations and for their personnel. Since this institution supports the preservation of the security in the United States, the US government, through its Department of Health and Human Service (DHHS), the US Food and Drug Administration (FDA) and the Center for Food Safety and Applied Nutrition (FDA), has established the ORM tool, which is part of their vision and strategy in the prevention and protection against food terrorism (^{DHHS, 2001}; ^{Rasco and Bledsoe, 2010}; ^{Veiga, 2011}; ^{Mitenius et al., 2014}).

ORM shares similarities with other tools applied in the area of Risk Management. For instance, the Hazard Analysis and Critical Control Points (HACCP) is used in the food supply sector for the analysis of accidental food adulteration risks and to preserve their harmlessness (^{Arvanitoyannis and Varzakas, 2009}). ORM also shares similarities with the Hazard and Operation (HAZOP), which is used in operational risk analysis to prevent industrial accidents (^{Cagno et al. 2002}). The aforementioned risk analysis tools are scientifically valid and widely accepted throughout the world (^{Rasco and Bledsoe, 2007}).

Methodology

A. Proposed KPI to Measure Intentional Contamination Risk

This paper proposes using a KPI for Food Defense. It is developed using a procedure that adapts some elements of the ORM, HACCP and HAZOP. It is closely aligned with the enterprise integration perspective and the business process vision throughout the functional limits of the organizations. Furthermore, the performance indicator can be applied to both inter or intra enterprise business processes rather than to a functional area, production stage or the equipment of a single company.

In general, the proposed procedure for the elaboration of the Food Defense KPI consists of three stages: first, the identification of intentional contamination hazards in business processes; next, the assessment of the hazards and; the last stage corresponds to the calculation of the Food Defense KPI in business processes.

It is worth pointing out that the proposed procedure for the creation of the Food Defense KPI is a very lengthy and time consuming job. It requires all possible damages, inside and outside the enterprise within the supply chain, to be tested in all the selected business processes against any food terrorism hazard. However, most organizations lack specific technicians, financial resources or time.

A multidisciplinary team formed by members of a company or its supply chain may help overcome this difficulty. Namely, with a common objective, they may share knowledge and experience in diverse fields of business processes. The actors of the business processes, preferably the ones involved at the executive level, may also take part in the team. The final product is the measurement of the performance level of Food Defense in the business processes. Such a measurement will indicate how effective these processes are at preventing food terrorism. This measure will help to establish the extent to which strategic Food Defense objectives are attained in the links of FSC.

Hence, this paper is an attempt to analyze the activities of an organization’s business processes and its FSC that are under risk of intentional contamination. This work also seeks to develop a Food Defense KPI that would lead to the application of adequate measures to overcome the vulnerability and reduce the risks in future business processes. Two stages are necessary. The first stage consists of the identification of the hazards and the second phase is the evaluation of the risks.

In the first phase, models for review and graphic representation of the identification and analysis of intentional contamination hazards in the business processes are helpful. In this matter, the works by ^{Aguilar-Saven (2004)}, ^{Neiger and Churilov (2005)}, ^{Sanchis et al. (2009)} and ^{Navarrete and Lario (2010)} are very useful. Indeed, they depict an array of properties that may help a designer to choose the right tool or appropriate modeling technique. The objective is to assess the vulnerability of business processes through the identification of the hazards in each activity (see fig. 1).

Fig. 1 Identifying hazards using a business process model 

Therefore, the models of business processes are useful for the analysis and identification of food terrorism hazards present in each of the activities. These hazards, found in each business process, are listed and checked in detail to facilitate their understanding. These checks must define clearly the vulnerability found in each activity.

It is important to make a distinction between "hazard" and "risk". "Hazard" is what may cause damage while "risk" is the probability of future damage. Consequently, "hazard" is a potential situation that already exists, while a "risk" is the probability of damage. However, in everyday usage, both concepts merge (^{Belland et al. 2010}).

The second phase of the procedure consists of a risk assessment. Some elements of the ORM are adapted from the point of view of a business and supply chain process. For each hazard of intentional contamination identified in business processes, the risk and the Food Defense value are established quantitatively according to three key aspects: severity, probability and exposure (^{DHHS, 2001}; ^{Belland et al. 2010}). The first key aspect for the evaluation of a risk is its severity. It refers to its potential internal (inside the enterprise) and external (the supply chain) damage. This can be physical, psychological, political or economic (^{Brummer, 2003}).

In general, there are some tools used for Risk Management that might also help to evaluate the severity and probability of risks, in order to sort them and prioritize actions to mitigate them. Some of the best tools are Failure Modes and Effects Analysis (FMEA), Fault Tree Analysis (FTA), Ishikawa diagrams ("cause and effect" diagrams) or "What if...? analyses".

During this phase, the Food Defense team formulates key questions such as: How does risk impact the supply chain and its constituents; the people and sales? The answers provide valuable qualitative information to determine the degree of vulnerability (^{DHHS, 2001}; ^{Belland et al. 2010}).

As a result of the analysis, the degree of severity is specified in these terms:

1. Catastrophic: complete failure in the constituent or in the links of the supply chain, due to the fact that the contamination causes deaths.

2. Critical: major degradation of the constituent´s image or in the supply chain, due to the fact that the contamination causes severe illnesses.

3. Moderate: minor degradation of the constituent´s image or constituents of the supply chain, due to the fact that the contamination causes minor damages.

4. Negligible: minimal degradation of a constituent´s image or of the links in the supply chain and minor consequences.

The second important aspect of the risk assessment is its probability, which refers to the assessment of the probability of occurrence of all causative factors. Indeed, some risks can happen frequently and others hardly ever. Some of the management risk tools, the experience of the participants or the evaluation of historical data can be applied. As a result of the analysis, the degree of probability is specified in these terms:

1. Frequent: the risk appears continuously during a defined period of time (which can be the average duration of the professional lives of participants, about 30 years) and reflects that the population is constantly exposed to the consequences of risks assessed.

2. Probable: occurs several times during the defined period of time and the population is regularly exposed.

3. Occasional: can occur at certain times during the period of time and the exposure to the population is sporadic.

4. Seldom: hardly occurs but is still possible. The exposure of the population or the resources is abnormal.

5. Not Likely: So improbable that we can assume it will not happen and the exposure of the population is not significant.

Along with the probability, there is a third important aspect of risk assessment: the exposure. This refers to the number of people or resources affected by a given event (or repeated events) for a period of time. The information is gathered with various tools such as: surveys, observations and inspections. By using the evaluation matrix (See table 1), the severity and the probability of each risk can be identified. The degree of exposure has an influence on the modification of the severity and probability values for each risk. These values may increase or decrease in order to be placed in the correct value range within the matrix of evaluation.

Table 1 Matrix of Risk Evaluation. Based on DHHS (2001). 

In the assessment matrix, ranges of quantified values are given for each risk of food terrorism identified in a business process. The values of Food Defense obtained are ranked from 1 to 20. Some ranges for categories of risk have been established (See table 2).

Table 2 Classification of risk values. 

Food defense value	Categories of risk
1-3	Extremely high
4-8	High
9-13	Medium
14-20	Low

Source: based on ^{DHHS (2001)}.

The data obtained from the risk assessment for each business process are compiled in a chart. The chart contains data about each of the identified hazards in the business process, the Qualitative and quantitative information obtained from the risk assessment for each hazard, the Food Defense values and the risk categories that correspond to the hazards evaluated in the business process.

The KPI of Food Defense is calculated in the last phase of the procedure. It is convenient to summarize the data with a single number when mentioning Food Defense values that correspond to each hazard assessed in the business process. Statistically, this number would tend to be placed in the center of the distribution of data. It is estimated that the distribution is symmetrical, in such a way that it does not look affected by the extreme values. For this, the arithmetic mean is used as the measure of central tendency. The use of the mean is due to the symmetry proposed to simplify the model. The Food Defense KPI of the business process corresponds to the rounded arithmetic mean of all the values of Food Defense obtained from the assessment of the risks that come from the identified hazards of food terrorism. Through the process of rounding, decimals are removed leaving only an integer.

()1

Where	Food Defense KPI of the business process
a	Food Defense value of the business process
n	number of Food defense values of the business process that come from the risk assessment for each identified danger.

Finally, the Key Performance Indicator (KPI) to measure the Food Defense in the business process of the food supply chain is obtained. The indicators make the elaboration of implementation procedures, the analysis and the improvement of Food Defense in business processes possible, by using current models (AS IS models) and by seeking for the creation of improved models (TO BE models).

Applying the proposed procedure for the development of the Food Defense KPI

The proposal has been applied to a food company, in the geographical area of El Bajío, Mexico². This company is dedicated to the manufacture of a food additive used mainly in the baking industry, which exports its product to major companies in the United States, Canada and South America.

By the challenge to deal with new security threats in the supply chain that the globalized world has today, the company was interested in taking into account food defense in its product quality-safety strategy, for the benefit of its customers, so it looked for new tools to improve in this area.

The proposal makes this possible, with the quantitative measurement of the risks of intentional contamination in the business process of a supply chain, providing key information for its management.

In the first place, the business processes with higher vulnerability to food terrorism were selected. Table 3 shows the complete list of the business processes. These processes are found in reception operations of raw materials and supplies, the storage of finished products and, their shipment. Most dangers of intentional contamination occur during these three critical activities.

Table 3 Modeled business processes. Source: compiled by autor. 

CODE	PROCESS	AREA
RMP-01	Ammonia raw material reception	Raw material reception
RMP-02	Carbon dioxide raw material reception	Raw material reception
RMP-03	Magnesium carbonate raw material reception	Raw material reception
RMP-04	Raw material reception-packing (bags)-	Raw material reception
RMP-05	Raw material reception-packing (superbags)-	Raw material reception
RMP-06	General material reception	Raw material reception
RMP-07	Assessment of ammonia raw material suppliers	Raw material reception
RMP-08	Assessment of carbon dioxide raw material suppliers	Raw material reception
RMP-09	Assessment of magnesium carbonate raw material suppliers	Raw material reception
RMP-10	Assessment of raw material-packing (bags)-suppliers	Raw material reception
RMP-11	Assessment of raw material-packing (superbags)-suppliers	Raw material reception
RMP-12	Management of non-conform raw material	Raw material reception
RMP-13	Management of non-conform material	Raw material reception
RMP-14	Management of non-conform service	Raw material reception
APT-01	Management of product storage	Product storage
APT-02	Management of raw material storage	Product storage
APT-03	Management of material storage	Product storage
APT-04	Assessment of logistics service suppliers	Product storage
APT-05	Management of non-conform product	Product storage
EMB-01	Management of produt release	Shipping
EMB-02	Management of product dispatch	Shipping
EMB-03	Management of product transportation safety	Shipping

The proposed procedure to develop the Food Defense KPI indicates that the identification of dangers of intentional contamination in business processes must be carried out in the first stage. One step in the BPM methodology (Business Process Management) was to verify the incidence of the AS IS and TO BE visions, suggested in ^{Navarrete and Lario (2010)}. In addition, the business processes were analyzed using models that could explain and represent them in graphs. Modelling business processes that are vulnerable to food terrorism helps identify the hazards of intentional contamination, assesses the risks of the hazards and improves Food Defense inside the companies involved in the FSC (See fig. 2).

Fig. 2 Detail level of the phases for the BPM methodology used. 

Hazards were identified in the activities where intentional food contamination in the company or its FSC could occur in both business processes; the ones that correspond to the current phase (AS IS) and the future phase (TO BE). Visio software helped speed up modelling. Moreover, it helped to replicate the real situation in the business processes with the application of the BPMN modelling technique (Business Process Modelling Notation), which is the standard used in Business Process Management (See fig. 3).

Fig. 3 A partial model of the EMB-02 business process in the AS IS phase 

The second phase of the procedure consisted of risk assessment. A qualitative analysis was carried out for each danger of intentional contamination that was identified in the business processes in the previous phase. The objective of this analysis was to review, in detail, any vulnerability that creates dangers identified in the business process. Then, quantitative analyses of the business process vulnerability were done, in the three identified areas: severity, probability and exposure.

Some tools from the field of Risk Management, for example FMEA diagrams and Ishikawa diagrams were applied. The Food Defense team also used these tools to assign the values in the risk assessment matrix (See table 2). They researched the literature and historical data. By consensus, the Food Defense team quantified severity, probability and exposure for each identified danger. Their Food Defense value and their risk category were then established. The data compiled in the phase of risk assessment was summarized in a table for each business process. Table 5 shows an example of this type of table.³

Table 5 A partial scheme of the information generated from the risk assessment of the RMP-01 business. Source: compiled by author. 

Danger Identification	Risk Assessment	Risk Category / Food Defense value
a) Transport operators do not record their entrance in the company.	a) Vulnerability qualitative analysis: By not registering any data (at least the operator’s name, signature and official identification), it is possible that the personnel operating the transportation could be a likely offender and intends to perform an act of food terrorism. Without a register, it is not possible to ensure that the entrance of vehicles and their operators is controlled. Vulnerability quantitative analysis: This is considered critical severity because it may affect a large number of final consumers and cause damage to the image of the constituents in the food supply chain. For example, in the case that an aggressor would focus on a 20-ton batch of ammonia, 60 tons of the final product could be affected. The possibility that an event would occur is considered rare. Indeed, history shows that such contamination has not occurred. It would be very difficult to commit an act of terrorism on a pipe of pressurized ammonia and special equipment would be needed. Finally, the quantity of contaminated product is large but the uptake rate is low, so the exposure level is minimal.	a) medium/11
b) Transport operators are not required to show any identification document.	b) Vulnerability qualitative analysis. The identity of the transportation operators is not verified. It is possible that the personnel operating the transportation could be a likely offender and intends to commit an act of food terrorism. Vulnerability quantitative analysis. The severity and the potential impact of this risk are considered critical because it may damage the image of the whole food supply chain by affecting a large number of people. The probability is rare. There is no epidemic associated to the contamination of an ammonia batch. The exposure is minimal due to the consumption characteristics of the product and the positioning of the company in the supply chain.	b) medium/11
c) When pipes arrive they are not checked for a seal or a lock that would secure their integrity.	c) Vulnerability qualitative analysis. The integrity of the material that is transported is not validated through the use of a seal or a lock that would guaranty the ammonia has not been manipulated during transportation or in any links in the FSC. Vulnerability quantitative analysis. The severity is critical because it would affect a large number of people. There would be a significant impact in the constituents of the food supply chain and considerable economic losses. Although there are no precedents of ammonia contamination during transportation, the probability that it could occur is high due to high exposure and the frequency of these events (on average, four deliveries per month).	c) high/4

Finally, the last phase consists of the calculation of the Food Defense KPI for each business process in the AS IS phase, using the equation of arithmetic mean (1) and rounding the result. On the basis of the improvement areas detected for each of the risks of the business processes analyzed, improved business processes were proposed (TO BE phase). The methodology of BPM presented in figure 3 was followed, as it explain how to carry out the analysis of phases, the implementation of the specific measures and continuous improvement.

It was estimated that Food Defense improvement from a comparison of the states AS IS and TO BE, using the results obtained from the KPI of Biosecurity from the business processes analyzed.

Analysis and Results

With the values obtained from the measurement parameters in the TO BE phase, the diagrams show an improvement of Food Defense within the modeled business processes. Thus, the Food Defense KPI value represents a lower risk of food terrorism compared to the models in the AS IS phase.

Fig. 4 shows the graph that compares the Food Defense KPI values of the business processes in the reception of raw material (RPM), with the range of values between 1 and 20, according to the proposed procedure.

Fig. 4 Improvement of the values for the Food Defense KPI in the RMP business processes. 

The comparison between AS IS and TO BE phase of the Food Defense KPI in the business processes of product storage (APT) and shipping (EMB) are shown in fig. 5.

Fig.5 Improvement of the values for the Food Defense KPI in the APT y EMB business processes. 

The Food Defense KPI results of the business processes that were analyzed show an improvement in the percentages of 125%, compared to the AS IS and TO BE phases for the analyzed business processes (fig. 6).

Fig. 6 Improvement the Food Defense KPI. 

In order to adopt the improved business processes relevant actions were taken to implement new activities. For this particular case, in order to mitigate the risk, almost all the measurements carried out were based on improving the inspection of the food material and control of external personnel. The implementation lasted approximately 3 months.

The impact of the Food Defense improvement with regard to other metrics of interest, such as cost and time, was also estimated. The costs estimate for technology, personnel, infrastructure, training and organization were also included. The running time of the business process is also affected by its modification or the addition of new activities.

Table 6 shows the comparative results for the estimates of the business processes duration. The addition of extra activities to improve Food Defense in the business processes was analyzed in the TO BE phase increases, in some cases considerably, for the duration of these processes (See fig. 7).

Fig. 7 Percentages of the increase in the duration of the business process in TO BE phase. 

Table 7 shows the results of the estimated costs in the AS IS phase of the business processes that had a change, compared to the costs in TO BE phase.

There were no significant differences between the AS IS and TO BE phases in most of the business processes with regard to estimated costs in the execution of these processes, with the exception of RMP-09 and RMP-11 processes. In these last two processes, the cost increased drastically due to the addition of an audit in the criteria for the assessment of suppliers, which takes into account the cost of personnel, logistics and organization (See fig. 8).

Fig. 8 Cost increase of the business process in TO BE phase. 

It is believed that the Company and its FSC wish to make the necessary changes in order to move toward the improved model of Food Defense in the analyzed business processes, for the following reasons:

Discussion

The following graph shows that some business processes with a slight increase in duration, due to the addition of some activities, have significantly improved their Food Defense (RMP-07, RMP-09, APT-01, APT-04, EMB-01 y EMB-03). Others need a more significant increase of the duration for some extra activities to attain a considerable improvement of the Food Defense. Hence, some changes are more efficient for the improvement of Food Defense than others (See fig. 9).

Fig. 9 Comparison between the Food Defense KPI improvement percentage and the duration increase percentage. Source: compiled by author. 

RMP-09 and RMP-11 business processes imply higher costs. The former has a significant improvement of the Food Defense KPI. The latter does not show a very good improvement (See figs 6 and 8).

Conclusions

The supply chain security is a central issue for the competitiveness of economies that goes beyond the prevention of terrorist acts or drug trafficking. Interruption of the supply chain, either by criminal acts, lack of stock of supplies or for any event that hinders the distribution of supplies or products, not only leads to economic losses by that failure in particular, but that also has a ripple effect to the rest of the chain, affecting ultimately its ability to be competitive. The supply chain security guarantees protection of the products in the entire chain, from the economic and documented aspects, to the related themes of manufacturing, packing, storage and distribution of merchandise, detecting the critical points, controlling and minimizing the risks and threats that could happen in all the phases.

Key Performance Indicator (KPI) developed to measure the improvement of Food Defense supports this goal, by controlling the risk of food terrorism and allowing the continuous improvement in the prevention of these attacks happening in business processes of the links of the FSC. Food Defense KPI allows the links in the FSC to establish how safe they are in regards of the prevention of food terrorism. Moreover, the article leads to research about the correlation between the Food Defense KPI with other important performance parameters, for example, cost and time.

In particular, the application of the proposal inside the food company facilitated its improvement in food defense and in terms of its supply chain security, so that it has achieved better its strategic objectives in this area.

Further research will seek at the inclusion of an indicator into a performance measurement system; with an integral perspective in the development of new alternatives for the elaboration of Food Defense KPI, and for the analysis of the relations with other measurement elements in each link of the FSC. In addition, it is possible to study how to extend its scope towards other links in diverse geographical regions. It is important to mention that generating the KPI has been considered for future work by using nonparametric statistics or fuzzy logic, in order to improve the statistical rigor, and the use of superior tools and techniques.