Audits are a fact of life in today's food industry. When chatting with other people in the industry, you may hear that many companies end up having one or more audits per month, on average. There is the yearly audit of the food safety management system (FSMS), usually done through one of the Global Food Safety Initiative (GFSI) audit schemes—SQF, BRC, FSSC 22000, or IFS (i.e., Safe Quality Foods, British Retail Consortium, Food Safety Systems Certification 22000, or International Featured Standard). 

In addition, many buyers establish programs to audit their suppliers outside of a yearly food safety audit, especially if the supplier is one that supplies ingredients or materials deemed to be of high risk. Some large corporations also conduct corporate audits of their own facilities. There are many special audits focused on enhanced marketability of the operation such as organic, Halal, Kosher, or an environmental management system audit such as ISO 14000. Lastly, a regulatory agency such as the U.S. Food and Drug Administration (FDA) may conduct an inspection—a topic we will cover more fully in another article.

Developing an Audit Management Strategy

Each food processor, ingredient manufacturer, beverage manufacturer, or food hander should develop, document, implement, and maintain a program that focuses on how to prepare for and handle an audit. 

This article will focus on food safety management systems, but it is important to understand that the basic program should apply to other audits as well. It is imperative that each operation establish a company philosophy that addresses audits by outside groups. Processors may not like audits, especially if the operation is subject to many different audits, but the company should treat every audit as an integral element of its FSMS and for the continual improvement of this system. The auditor can often help enhance existing programs by asking a simple question such as, "Why do you do it that way?"

Selecting an Audit Scheme and Certification Body

One of the first steps for building an audit program is selecting the audit format that is acceptable to the company's buyers. As noted above, the FSMS audit schemes most commonly accepted by customers are the GFSI audit schemes, but there are other, private systems. Looking at audits as an element of continuous improvement, companies should closely consider the audit schemes and select the one they believe would be most beneficial to their operation. 

The next step is to determine which certification body to contract with for the audit. Consider talking with your customers when selecting the audit scheme and certification body. One thing to take into account when making these decisions is whether the scheme and method are considered an audit only, or a total assessment. The late Dave Park presented an excellent overview of this subject.¹ An overall assessment is preferable because it not only checks to ensure that a program is in place but also determines whether it is effective. An assessment will take longer and requires a knowledgeable auditor. Do not select an audit scheme that bills itself as a checklist audit; you want more than a checked box.

Developing, Documenting, Implementing, and Maintaining Procedures

One of the challenges of an FSMS audit is that many different systems or programs will be part of the audit. Processors must develop, document, implement, and maintain protocols for each of these areas, some of which are quite complex. 

As an example, when establishing procedures for cleaning and sanitizing, most companies establish a general protocol outlining the goals and general requirements and then establish specific cleaning procedures for each piece of equipment, floors, walls, overheads, the grounds, and any other areas that must be cleaned. 

“An error that many companies make is deciding to review and update protocols immediately preceding an audit.”

The list below shows 38 different areas or elements of the FSMS for which procedures may be needed in your plant:

1. Organizational chart
2. Quality mission and policies
3. Stakeholder list
4. Communication guidelines (internal and external)
5. Food safety committee/HACCP team
6. Master cleaning schedules
7. Documented cleaning procedures
8. Ingredient shipping and receiving procedures and records
9. Trucker policy
10. Specification manual: Ingredients, packaging, and finished goods
11. Letters of continuing guarantee and certificates of authenticity (COAs)
12. HACCP program
13. Plant policies such as Good Manufacturing Practices (GMPs) and training
14. Allergen program
15. Consumer complaint program
16. Recall and traceability program
17. Non-conforming products procedures
18. Regulatory inspection program
19. Processing standard operating procedures (SOPs) and recordkeeping
20. Change control procedure
21. Process deviation procedures and log
22. Product testing program
23. Vendor approval program
24. Glass and brittle plastic program
25. Preventive maintenance program, including emergency repairs
26. Pest control program manual and records
27. Sampling procedures
28. Sifter/screen logs
29. Metal detection program
30. Foreign material detection logs
31. Distribution records
32. Programs for receipt of perishable materials
33. Calibration procedures and logs
34. Water quality program
35. Procedures for clean-in-place (CIP) cleanup evaluation
36. Food defense security assessment and plan
37. Corrective and preventive actions (CAPA) log
38. Legal requirements and applicable regulations.

Part of the implementation and maintenance for each protocol is making sure that every person who is involved with the procedure has been properly educated on it, and there is a record that the education session was documented. An error that many companies make is deciding to review and update protocols immediately preceding an audit. They make changes to a protocol, yet fail to conduct proper training on the updates. 

As an example, a company may change a cleaning procedure on October 1 ahead of an audit scheduled for October 3. The auditor sees the date on the updated protocol and asks to see training records—which do not exist. If your company plans to update procedures, either ensure there is time for training or wait until after the audit to make the changes.

“Another way to speed up the audit is to get the auditor copies of the procedures ahead of time… These documents will be surrendered when the program is over.”

Preparing for the Audit

A processor can do several things to prepare for an audit and even help streamline the process. Depending on the type of audit and the size and complexity of the facility being assessed, the audit may take several days and sometimes entail a team of auditors to do the work. The first thing to do is be proactive. Contact the auditor(s) and ask if they have any needs, such as lodging. If you can help them find a good, local hotel that offers a discount, do so, as your company will be invoiced for expenses.

Another way to speed up the audit is to get the auditor copies of the procedures ahead of time. Many companies worry about confidentiality issues, but sharing procedures can speed up the audit. If the auditor spends two hours reading the HACCP plan ahead of time, that is a significant savings in time and even understanding. Some companies may be wary about sending documents over the internet. The author has found that companies are more comfortable sending hard copies of documents to auditors with the understanding that these documents will be surrendered when the program is over.

Preparing Management and Staff

Audits have evolved over the years. Today, auditors want to talk to people who not only manage different areas within the processing facility but also line workers doing key tasks such as monitoring critical control points. Companies should prepare a document (e.g., Figure 1) that highlights different management areas and the managers themselves. 

Since management responsibilities are continuously changing, processors need to set a schedule for reviewing and updating this document as needed. This is also a very useful tool when working with the auditor, as they will want to talk to different supervisors. Companies should also work with line workers to ensure they fully understand their jobs and can articulate what they do. Auditors will interview line workers and expect that they will be able to describe not only what they do but also why it is being done. 

Entrance Meeting

Every audit begins with an entrance meeting. The auditor will describe the audit, their timetable, and the people with whom they wish to talk. Every manager on the list in Figure 2 should attend the meeting to meet the auditor and provide a business card. Facility management should work with the audit team to establish a schedule with the management team present. If the operation includes a cleanup shift, plans will need to be made for what may be a late evening visit so the auditor can observe the cleanup crew at work. 

One useful addition to any audit of the FSMS is to ensure that key vendors are available to talk to the audit team. These may include the pest control operator, a trucking firm, and a representative from a contract cleaning crew. As an example, having the pest control operator available can ensure that the auditor fully understands the "how" and "why" of the facility's pest control procedures. 

The author has seen how the presence of the pest control operator resulted in an audit firm not penalizing the company for certain items. In one example, an auditor was ready to cite a processor for not having bait stations. The pest control operator explained that there were no rodent populations in the area, so bait stations would have been a needless expenditure.

The Audit Itself

Audits consist of two basic elements: (1) plant visits and observations, and (2) what is known as the "desk audit," which consists of a review of documents (procedures, protocols, and records). The first thing the audit team usually wants to do is see the operation, so a walk-through from receiving through warehousing, production, and shipping will be in order. The auditors will also want to walk around the grounds to check for standing water, cleanliness, and maintenance. They may wish to go back and forth from a conference room to different parts of the facility as an addendum to the desk audit.

“If your company keeps digital files, make sure that one or more people who are working with the auditor know where to quickly find specific procedures or records in your system.”

As an example, the auditor may look at the procedures for receiving materials containing food allergens and then ask to go to the receiving area, procedures in hand, to verify that the protocols are not only being followed but are also effective. Hopefully, the audit team will spend more time making observations than sitting at the desk, but that is not always the case. There are many procedures and records to review. 

Years ago, most companies used binders and/or paper files to maintain procedures and records. Some still do this, but there has been a large-scale switch to digital filing. If your company keeps digital files, make sure that one or more people who are working with the auditor know where to quickly find specific procedures or records in your system.

Exit Interview

At the conclusion of the audit, the auditor will meet with the management team to discuss findings and concerns. Good auditors will address issues when they see them and will discuss why the issue is a concern. Many processors will immediately address such observations and initiate corrective actions, which should be relayed to the auditor at the exit interview. If the issue originated in the plant, ask the auditor to revisit the issue to see if they are satisfied with the correction. The auditor will log the issue in the report as having been addressed. 

The auditor is not all-seeing or all-powerful, however. There is nothing wrong with challenging the auditor's assessment. I once did a pre-audit for a client that contacted me after their audit and said they had been cited for not having an environmental monitoring program (EMP). I said they did not need one and explained why. The company challenged the auditor and provided the background, quotes from the Preventive Controls regulation found in 21 CFR Part 117, and in-house data. The auditor called the home office, described the situation, and was told the company was correct; it did not need an EMP program.

Summary

The bottom line is that your company, as a food processor, is going to be audited. There will probably be more than one audit with different objectives. Develop programs to make these audits as painless as possible for your management, your employees, and for the auditors themselves. Good planning and organization will streamline and speed up the audit and often impress the audit team, so consider these guidelines when planning for the inevitable next audit.

References

1. Park, D.K. "The Difference Between a Food Assessment vs. a Food Audit." Food Quality and Safety. May 15, 2019.