BROWSE ALL ARTICLES BY TOPIC
Lessons Learned from GFSI Audits
Be prepared with documents and answers
by Patrick Bele
Achieving GFSI (Global Food Safety Initiative) certification can ensure consumer confidence in product safety. Among the many existing standards available for audit or certification, GFSI has selected several that are applicable to the food manufacturing industry.
I have conducted certification audits worldwide, and the lessons learned through these audits are applicable to any manufacturing site, whether the facility is in Arkansas or the U.K. This article covers several programs: SQF 2000, BRC Food (Global Standard for Food Safety), IFS Food, and the more recent FSSC 22000. Sector-specific standards such as the Global Red Meat Standard and very small programs such as Synergy are not included.
Organizations should be aware of several issues prior to a certification audit:
Depending on the chosen program, the certification audit may include a separate document review to assess the food safety management system’s readiness. Once this step is complete and all preliminary findings are cleared, the on-site implementation audit will begin. During this step, the auditor will assess the following:
- Are your documentation and facility in line with the standard?
- Are you implementing what has been described in your documentation?
- Is your product meeting the food safety and quality regulations and customer requirements outlined by the standard?
Whichever program you choose, the auditor will have limited time to assess all clauses of the standard. As an example, BRC Food contains no fewer than 326 clauses covering food safety and quality that have to be assessed in a typical 1.5-day audit. This makes the pace of the certification audit quite hectic, and the auditor will not be able to wait long for the needed documents and records. Therefore, the key to a successful audit means:
- Having documentation easily accessible and
- Having your personnel (from top management to maintenance technicians) acquainted with receiving external auditors and answering their questions.
Some standards also have identified key topics, called KO or Fundamentals. Failing one of these critical requirements means not achieving certification and starting the audit process over from the beginning.
To ensure that you comply 100% with must-pass requirements before a certification audit begins, ask a certification body to perform a pre-audit. This exercise follows a process that is similar to the one used in a certification audit, but your certification will not be at risk. At the end of the pre-audit you should know whether your site is compliant with key requirements and how much work is needed to achieve certification.
To ensure that you comply 100% with must-pass requirements before a certification audit begins, ask a certification body to perform a pre-audit.
Management System, Organization Issues
The policy: All GFSI benchmarked standards ask for a management system covering food safety and some quality (customer satisfaction). The policy should be supported by measurable objectives, which can be easily developed when dealing with customer satisfaction but will be more complicated for food safety. The lack of measurable food safety objectives is often observed, so at least one objective should be included. Companies measure their food safety performance through different metrics, such as internal hygiene audit results, microbiological test results, or customer complaints linked to food safety.
The policy should explicitly state that products must meet legal requirements. This may sound like an obvious statement to include in a policy, but it also makes sense when shipping products abroad. Additionally, continuous improvement should be mentioned in the policy and must be implemented through documented corrective and preventive actions.
The management review: The management review should follow a detailed agenda that is precisely described in each GFSI standard. We often find that compulsory topics are not addressed during the management review. These inputs are usually external audit results, hazard analysis and critical control points (HACCP) studies, previous meeting action plans, and scientific and regulation updates. To avoid such issues, build a template for the management review agenda and stick to it.
The organizational structure: Companies are constantly changing, and organizational charts should be updated accordingly. New managers, new positions, or new structures are not always translated immediately into the organizational charts. Some standards also require job descriptions; have these readily available and updated if needed. Document the backup plan for key positions.
Customer focus and complaints: For the standards addressing food safety and quality, an organization must build performance indicators related to customer satisfaction. Although customer satisfaction monitoring is not hard science, some metrics can be implemented, such as traditional surveys, credit notes, order fill, or market share. Whichever standard is chosen, make sure that customer requirements are communicated and implemented throughout the entire operations process. Keep a record of complaints, your investigations, and how you have communicated with your customers and consumers.
Internal audit: Some standards require that every department be audited internally once a year. Make sure all departments impacting food safety or quality are included in your internal audit schedule. Ensure that auditors are independent from audited activities. For smaller companies, the support of a consultant can be the solution. For a larger corporation, an outside auditor can bring an objective look, as well as deep knowledge of your processes.
When we review internal audit reports, the corrective action definition and follow-up are sometimes missing. Once the internal audit is performed, allow reasonable time to define corrective action and follow-up accordingly.
Purchasing: Vendors play an important role in ensuring food safety, but organizations often lack defined criteria for vendor selection and ongoing evaluation. Some standards also require defining a trial period for new vendors. Include these points in your documentation.
Documentation: Documentation can help prevent findings, especially when a robust control system and thorough internal audits are implemented. Most issues are related to missing or outdated product specifications (including packaging, raw materials, and chemicals). Good internal communication will ensure that any change in vendor/recipe is widely communicated internally. Some standards also require that document changes be recorded, with documentation explaining procedure modifications. Describing what has changed compared to a previous version is not sufficient; you must include the reasons for the change.
Corrective and preventive action: Corrective or preventive actions are often implemented but are not documented or tracked for efficiency. Implementing the action is more important than recording it, but keeping good records ensures a documented history of solved issues and can help maintain knowledge within the company.
Traceability: Ensuring traceability is often required in the regulations, but GFSI standards require more. Packaging material traceability is often overlooked and can be difficult to implement when packaging materials do not have an easily accessible batch number. Discuss this topic with your packaging vendor to make sure you record the right data. Note also that some standards require mass balance checks, a powerful tool to test the reliability of your traceability system. Finally, reworking the product should not jeopardize traceability.
Incident, withdrawal, and recall: Being ready to manage a crisis requires a detailed and updated procedure that is regularly tested. This document should include an up-to-date list of key contacts—internal, authorities, customers, and even the certification body for some standards. Understand the FDA’s new food registry, which has been designed for these kinds of issues. Your records should include any conclusions about withdrawal testing results, whether you were satisfied, and where improvement is needed.
The cornerstone of a robust food safety system, HACCP documentation and its implementation, is being scrutinized by third party auditors. Certification body auditors will focus more on the implementation than on the documentation, but both are needed.
Food safety team: The most effective teams are multidisciplinary, but departments such as maintenance or procurement are often overlooked. A team leader should be named and documented either in the HACCP manual or in a job description. All members should be knowledgeable about HACCP methodology, either through initial education or ongoing training.
Product description: New products should be included in the HACCP documentation and should not be sold before going through the hazard analysis. Don’t forget to describe the unintended use of the product. For companies shipping abroad, the list of applicable regulations in destination countries must be identified.
Process flow diagrams: No standard will tell you how detailed flow diagrams should be, but some elements must appear. Often missing are the following: trash, packaging material, rework, and water treatment (provided water is an ingredient). When performing the on-site verification of these flow diagrams, do not forget to keep a record of this compulsory step.
Hazard identification: Biological hazards are usually well identified and addressed, but chemical and physical hazards are sometimes overlooked, even though they can be well controlled in the operation workshop. Pesticides, medicine residues, grease, cleaning chemicals, and heavy metals should not be forgotten at this step. Some GFSI standards even require that you assess deliberate contamination hazards, usually referred to as bioterrorism. Keep records of the hazard assessment against likelihood and severity.
CCP: The definition of CCP can lead to endless debate between auditor and auditee—and between auditors themselves. If you consider a control measure/processing step a CCP, you must define the critical limits, the record for monitoring, and the corrective action, in case the CCP is out of control. No product should be released until all CCPs are found compliant. As a rule of thumb, if you find more than 10 CCPs, some are probably not actual CCPs.
Validation is another hot topic with CCP. Often misunderstood, the validation of a CCP means making sure the control measure will achieve its objective in terms of acceptable level of food safety. Validation should answer whether the CCP can consistently reduce the hazard to an acceptable level.
Review/management of change: The HACCP study should be reviewed at least annually. More importantly, any change that could affect food safety should be reviewed prior to implementation. The list of changes in that category can be quite long, including recipes, ingredients, vendors, equipment, regulations, and customer requirements. Meeting this demanding requirement requires efficient internal communication within the manufacturing site and also with headquarters.
Site Standard Issues
Not all factories are equal with regard to site standards. Recently built sites with state-of-the-art equipment will have a strong competitive advantage over older facilities that need to invest in upgrades.
External standards: Most GFSI standards ask that the external site environment be assessed regarding food safety. Sometimes misunderstood, this clause means that you should be aware of your neighbors’ activities and understand whether those activities could affect the safety of your products.
Security: U.S. factories are usually well prepared with regard to security requirements, although there can be implementation issues, such as doors that are left unlocked or security systems that are disabled to ease traffic flow. Make sure that your internal training program includes security and that appropriate records are maintained.
Segregation: Usual findings are lack of segregation between processes and cleaning of utensils that could lead to cross-contamination.
Building: Although recent buildings are more likely to meet GFSI requirements, well-maintained or upgraded older facilities can still do so. Our most common findings are external doors that do not fit closely, unprotected light in a production area, and dirty air filters. A thorough visual inspection should prevent most of these issues.
Maintenance: A common finding is the use of tape for temporary repairs, a practice that jeopardizes food safety. After maintenance operations, most standards require a clearance to ensure that equipment is clean and that no parts or tools remain. When buying new equipment, keep all food grade certificates provided by the machinery provider. Make sure that the maintenance department monitors steam and compressed air.
Staff facilities: Most GFSI standards require clear segregation between outdoor clothing and work clothing. A regular and thorough inspection of locker rooms is needed to ensure compliance with this clause.
Chemical and physical contamination: Chemical auditors usually observe unlabelled containers and missing MSDS. The most common contamination issues are glass registers that are hard plastic or are not regularly checked.
Pest control: These requirements are usually very detailed in GFSI standards. A close reading of the standard should allow you to dodge the traps. Auditors often observe the lack of trending and outdated bait maps.
Implementing the action is more important than recording it, but keeping good records ensures a documented history of solved issues and can help maintain knowledge within the company.
Product Control Issues
For the GFSI standards considered product certification (vs. system certification), auditors will strongly focus on product compliance.
Product design: New products should undergo a hazard analysis prior to being placed on the market. Because product legality is also part of the audit scope, labeling must comply with regulations of destination countries.
Allergens and similar: Even though the trend is toward allergen avoidance, keep record of the training course for staff who handle some of these materials. Ensure that your reworking rules and practices are not compromising allergen status.
Product packaging: Packaging material must be suitable for food, and the related certificate must be readily available to the auditors. On the floor, ensure that partial boxes/pallets of packaging material are properly protected before returning them to storage.
Product inspection and testing: Whether testing is performed on site or contracted, react quickly when results are not satisfactory. Too often we observe test results without interpretation or a pass/fail conclusion. Testing reliability should also be ensured through proficiency testing and accreditation of laboratories. Some standards require an ongoing assessment of shelf life.
Nonconforming product: GFSI standards aim to prevent nonconforming products—whether in raw material, packaging, test kits, or finished goods—from proceeding in the manufacturing process. For this purpose, all nonconforming products should be identified as such. Furthermore, the correction (what you did with the product itself) and corrective action (what you did to avoid recurrence of the issue) should be recorded.
Process Control Issues
Product quality control relies on testing and on process control. For example, continuous monitoring devices such as metal detectors should be tested, and appropriate records should be available. Calibration is sometimes overlooked, but many findings could be prevented with a thorough reading of standards requirements. Make sure your measuring equipment is properly identified with up-to-date calibration status. In addition, GFSI standards demand that you investigate the validity of previous measurements in the event of unsatisfactory calibration results. This requirement is often misunderstood or forgotten.
Product quality and safety cannot be ensured without properly trained and competent staff.
Training: Be prepared to show training records for hygiene, food safety, and handling of allergens. Not knowing exactly where all these records are kept could cost you some easily preventable findings, maybe even minors. GFSI standards require a view of the effectiveness of training courses. These training courses can range from a traditional quiz that ensures understanding (but not efficiency) to the yearly performance review with supervisors.
Personnel hygiene: Implementing hygiene rules requires effort. A hygiene culture should be implemented throughout the company, and this requires commitment by top management. If the culture is not there, the auditor is likely to observe some implementation issues dealing with jewelry, hand washing, or hairnet adjustment, among other possibilities. Hygiene audits or walks can ensure that all personnel are adhering to hygiene rules. Additionally, some standards require the use of colored Band-Aids and make it clear that medicine use must be addressed by site hygiene rules. Cleanliness of work wear should be assessed.
This quick summary of the most common issues found when auditing against GFSI standards will hopefully help you focus your efforts prior to the certification audit. Reading the standards and performing an internal audit should give you good insight into your strengths and weaknesses. If you question your readiness, consider a pre-audit, which will give you needed guidance.