My phone has been ringing a lot lately. It is not the "We'd love your strategic input" kind of call, but the "We screwed up, and we need you here A.S.A.P." kind. The system has been drifting toward a cliff for years, and I am watching companies drive over it, one at a time. It is an ever-increasing trend. They are always in disbelief when it happens.

Here is what the calls sound like. They have a track record of high GFSI audit scores—upper 90s across the board. The CEO has been using those scores to reassure the board and drive new business. The dark side is that the same scores are used to sideline quality, food safety, and sanitation with yet another budget trim. The message is to be "good soldiers" and follow "marching orders." Then, it reaches the tipping point. The company colossally fails a supplier audit, or worse, must initiate a recall. Then, someone is calling me.

In addition to being a one-woman quality response unit, one of the things I do is gap assessments before certification audits. I go in ahead of the official visit, reviewing systems and facilities within the certification framework, to help facilities understand where they actually stand. At other times, I assist junior professionals during their audit, because it is more economical for some companies to hire less experienced people and bring me in once or twice a year to mentor them. What I relate here is firsthand. When I do pre-audits, I am finding garbage, and these are not minor housekeeping items. These are fundamental breakdowns in the controls that keep food safe, at facilities that have been scoring in the high 90s on their official audits. It is not uncommon for me to leave with 40-plus majors and minors at a facility that repeatedly received a near-perfect score from a certified third-party auditor. I came up through operations and engineering before moving into food safety leadership, which is why I know what a line running wrong sounds, looks, and smells like before anyone pulls a record. I also understand operational inertia well enough to call it out directly when I see it. I am looking at the things that are going to snowball.

Let that sit for a moment. Then ask yourself what those scores were actually measuring.

The Score is Not the Facility

A GFSI certificate is a snapshot. It explains what a facility looked like over the course of a scheduled visit, evaluated against a defined checklist, by an auditor operating under incentives that do not always reward fearless findings. I genuinely love the food manufacturing industry and do not enjoy delivering bad news. However, when someone hires me for a job, I do what I am paid for, and it is not to add more false assurance to a world that already has too much of it. Good companies lean in and do not get defensive.

I was a vocal supporter of GFSI harmonization when it launched, and I still believe in the underlying mission. I have seen too many failures, however, to treat a certificate as a guarantee of anything in the current state of food manufacturing. The currency has been devalued. It is more like a "hot check" that has not been deposited yet, and it has become a marketing tool. When a facility scores beautifully on paper and cannot perform in practice, the certificate actively misleads everyone downstream. It gives executives permission to stop paying attention. It gives leadership permission not to approve a site inspection. It gives the supply chain a false floor.

Published research has documented that multiple foodborne illness outbreaks were linked directly to facilities that passed third-party audits with high scores, in some cases just weeks before the event.¹ Auditing conducted the wrong way, under the wrong incentives, against the wrong metrics, produces false assurance, and false assurance can be more dangerous than no assurance at all. The annual economic burden of foodborne illness in the U.S. has been estimated as high as $77.7 billion, and approximately 3,000 people die every year from contamination that was, in nearly every case, preventable.²

What I Keep Finding When I Get There

What I am finding, consistently, is that the score and the floor have diverged: not by a little, but by a lot. Cold chain protocols exist entirely on paper. Sanitation programs are documented, verified on the checklist, and not running when they are supposed to. Allergen management falls short in ways that should alarm anyone paying attention. Pest activity turns up in active production zones without meaningful corrective actions. Co-manufacturing arrangements are happening that no one upstream in the supply chain knows about, including sometimes the brand whose name is on the package.

A decade ago, I was asked to approve a facility. This one had everything going for it on paper: a major brand name and a corporate GFSI certificate, the kind that covers the parent company. The new acquisition had come after the last audit, but we were apparently not supposed to recognize that. They presented a polished supplier packet and a price point that should have been the first warning sign. My boss was impatient and wanted my approval on the certificate. This was, after all, a national player. I reminded him of the time I had caught a co-packer turning up line speeds and shutting off chillers, and told him he was welcome to sign off himself and own whatever came next. Begrudgingly, the assessment was approved.

“We do not need more certifications or regulations. We need support for competence.”

I usually drive or walk the perimeter of a supplier before going through the front door, because facilities tell you things about themselves before you even sign in. What I found at this one was nothing like what the certificate promised: garbage and potholes with standing water, birds circling waste and bathing in puddles outside an active production facility, a sidewalk that was a mosaic of contamination likely to be tracked straight through the door. There was no ID check at entry. When I asked about trailer temperature documentation, they told me they wrote whatever number was expected because they could not find the thermometer. I kept waiting for someone to pop out and tell me they were filming it to see if they could make me lose my cool.

When I asked to see where our product would be stored, the mood shifted fast. The frozen storage area contained product from a prior power failure that had thawed and partially re-solidified on the floor. I took a step, my foot lifted, and my shoe stayed behind. I had to pry it free while balancing on one foot to avoid stepping sock-first into the residue.

That was a GFSI-certified company. We did not use them. I also received a coaching about my choice of language in the debrief. Apparently "cesspool" was considered too colorful even for internal documentation. I stand by it. The statistics do not lie: the industry is not getting better. It is getting worse at an alarming rate. We do not need more certifications or regulations. We need support for competence.

Why Audits Miss This: A Structural Problem, Not a People Problem

Most of the auditors I know are dedicated professionals doing a difficult job under conditions that make honest, deep assessment genuinely hard. I am frequently asked who the "easy" auditors are. The audit score has become the requirement for entry, and the market has adjusted accordingly.

Certifying bodies are not paid to fix problems. When an auditor uncovers a major nonconformance, they inherit a corrective action process involving documentation review, follow-up, and verification, all without additional compensation. The incentive, however unconscious, is to stay at the surface. Checklist-based formats, now increasingly tablet-based, allow audits to be completed more quickly and require less depth than genuine systems assessment. I was told recently that I could get an audit done in half the time if I did not "waste time" documenting what I had reviewed. I said we could save even more money if I filled out the report at home in my pajamas while sipping on a cocktail, but that would rather undermine the whole point of the audit.

Junior auditors are routinely asked to evaluate complex food safety systems with little or no industry experience and make consequential judgments about hazard controls. This is a mistake. When I am onsite, procedure review is secondary to physical presence. On the floor, I can review actual records rather than policies that perfectly regurgitate the standard back at me, and I can recognize that it is 2:00 p.m. but the 4:00 p.m. line check has already been logged as in range, even though the line is diverting. The smell of a facility tells you things that no corrective action log ever will. Yet when I am onsite alongside auditors, I watch them spend around 96 percent of their time scrolling through procedures or flipping through the manual. When they hit operational resistance, I end up playing interpreter to make sure legitimate findings land. I mentor those auditors at every opportunity because it needs to be done, and they appreciate it.

The Age of 'Fake-and-Bake'

I have been verifying certificates against issuing certification bodies since 2014, when I caught my first fraudulent one. The patterns repeat: a legitimate company name digitally overlaid on another facility's information; a real corporate certification that excludes the specific co-manufacturing site actually producing the product; expired certifications presented as current; scope statements that conveniently omit high-risk production lines. None of this requires sophisticated fraud, and all of it passes undetected in programs where no one is verifying. A price point that seems too good to be true is always a risk signal. It means someone is cutting something somewhere, and your job is to find out what it is before it finds you.

What CEOs are Getting Wrong

High scores do not mean the system is working. They may mean any number of things, for example:

• The system has learned to perform for audits
• The food safety team has been compensating for structural underinvestment so effectively that the gap has not yet become visible
• The company has found one or more "easy" auditors that grant high scores
• The plan is to simply keep up the "good vibes" until the accountable personnel retire.

I have worked alongside teams raising concerns for years: detailed, documented, professionally delivered concerns minimized because the audit scores were fine. Those teams were not wrong; the scores were. The score with the pizza party and printed t-shirt was never the story. When the crisis call comes—and in these situations, it will eventually—the cost of remediation is always a multiple of what it would have taken to do it right in the first place. Meanwhile, the quality team that was raising the alarm takes another hit. Is it any wonder that good people leave?

Your quality team is not the problem. Listen to them before I have to come fix it.

Now, About Who Gets to Audit Any of This

Here is where I have to introduce a layer of irony that I genuinely could not have invented if I tried.

I came up through operations and engineering before transitioning into food safety leadership, which means I have stood on both sides of the audit relationship. I am a chemical engineer with a master's degree in engineering management. I hold FSPCA Lead Instructor and HACCP instructor certifications, meaning I teach the curriculum that trains the people who run food safety programs. Part of my current work includes auditing against the certification standards, doing gap assessments before official certification audits. My phone rings when companies face serious food safety crises, including recalls, because I have the experience to drive the turnaround.

“The researchers who have spent decades documenting the human cost of foodborne illness and the practitioners walking those floors every week are not opponents. We are looking at the same problem from different angles, and the industry needs both perspectives at the table.​​”

Under GFSI's Benchmarking Requirements Version 2024, currently being implemented across Certification program owners (CPOs) including SQF, BRCGS, and FSSC 22000, it is a legitimate open question whether I could even qualify as a third-party GFSI auditor, depending on how individual certification bodies apply the "or equivalent" provision.³ GFSI's Benchmark Requirement 4.9 (2024) requires auditors to hold a degree in a food-related or relevant science or technology discipline. GFSI issued a Technical Advisory Note in late 2025 clarifying that the requirement is not intended to exclude practitioners who developed competence through professional training and relevant experience,⁴ but a statement of intent in an advisory note is not a functional pathway.

I am qualified to walk into a facility with a gleaming GFSI certificate and find 40-plus majors and minors, to stand in a frozen storage area prying my shoe off a floor of re-solidified thawed product, to tell a CEO their supplier is a liability dressed up in a nice package, and to teach the FSPCA curriculum. Under the new rules, however, I do not qualify to be an auditor for a certifying body because I do not meet the education requirements. Nor does the framework create any pathway for experienced practitioners to contribute as mentors or advisors to the least experienced auditors at the most problematic facilities.

The industry is facing a documented, severe auditor shortage. A U.S. Department of Agriculture National Institute of Food and Agriculture (USDA-NIFA)-funded workforce analysis published in Food Safety Magazine in April 2025 described it as "dire" with "far-reaching implications."⁵ GFSI itself called it "a severe threat to the whole food safety ecosystem" in 2021.⁶ That was four years ago, and the pipeline has not recovered. Adding credential barriers that existing, experienced practitioners cannot easily clear is not a solution to a shortage. It is a mechanism for accelerating one.

What a Better System Looks Like

The researchers who have spent decades documenting the human cost of foodborne illness and the practitioners walking those floors every week are not opponents. We are looking at the same problem from different angles, and the industry needs both perspectives at the table. What we do not need is more certifications or regulations. We need support for competence. Here is what that looks like:

• Verify certificates, rather than filing them. Confirm every certificate against the issuing body's database. The tools exist, and the step takes minutes.
• Scope is everything. A corporate certificate that excludes the specific facility touching your product is a prop.
• Audit based on actual risk. Cold chain, allergens, co-manufacturing, and high-hazard categories require deep evaluation. A price point too good to be true is a risk signal.
• Put auditors on the floor, including pre-operations and off-peak hours, even when that means a 4 a.m. start. If that shift runs, the auditor can, too.
• Talk to the people doing the work. Auditors who put people at ease learn what the building actually contains.
• Apply "or equivalent" as if you mean it. CPOs and certification bodies need to operationalize GFSI's intent with specific, transparent criteria, not leave it to case-by-case interpretation.
• Invest in the pipeline deliberately through apprenticeship models, academia–industry partnerships, and scholarship programs that complement operational experience pathways, rather than substitute for them.
• Recognize that executive accountability is part of the system. The quality department is not your problem. The score was never the story.

The Stakes

Food safety auditing is not a compliance exercise. It is a public health function. The Boar's Head Listeria outbreak and the Abbott infant formula recall are what happen when verification systems fail and paper and practice diverge long enough so that a preventable hazard becomes a national crisis.

People sometimes ask why I push so hard, and why I do not soften my approach to be more marketable. Frankly, if I had simply gone along, I could have retired by now. The answer is that in 2009, my son nearly died from E. coli O157:H7 in contaminated food. He survived—with dialysis, blood transfusions, and permanent kidney damage—and his medical costs now exceed $750,000. I sat beside him in Seattle Children's Hospital while my phone buzzed with recall notices for the products that put him there. I knew exactly what those notices meant, and with a little digging I soon knew exactly what had failed. That is not a credential. It is a reason.

A certificate is only as good as the input behind it. The people whose lives depend on what comes out of these facilities deserve the full picture.

The phone keeps ringing. I keep showing up. Somewhere in a conference room, a CEO is looking at a score of 98 and feeling reassured that he deferred hiring quality managers for five facilities and gave their single, overloaded senior quality manager a token raise, while she spends her lunch breaks updating her resume.

Note

The Bioeconomy Information Sharing and Analysis Center (Bio‑ISAC) is a nonprofit, member‑driven organization that serves as a trusted hub for sharing and analyzing threat information specific to the life sciences, biotechnology, and broader bioeconomy sectors. Its mission is to improve cybersecurity and biosecurity resilience by enabling confidential, two‑way exchange of intelligence on vulnerabilities, incidents, and emerging risks among industry, academia, and government, and by supporting coordinated vulnerability disclosure, workforce training, and practical guidance at the cyber‑bio interface.

References

1. Powell, D.A., S. Erdozain, C. Dodd, R. Costa, K. Morley, and B.J. Chapman. "Audits and Inspections are Never Enough: A Critique to Enhance Food Safety." Food Control 30, no. 2 (August 2013): 686–691. https://doi.org/10.1016/j.foodcont.2012.07.044. 
2. Scharff, R.L. "Economic Burden from Health Losses Due to Foodborne Illness in the United States." Journal of Food Protection 75, no. 1 (January 2012): 123–131. https://www.sciencedirect.com/science/article/pii/S0362028X2300426X. See also: Scharff, R.L. "State Estimates for the Annual Cost of Foodborne Illness." Journal of Food Protection 78, no. 6 (June 2015): 1064–1071. https://www.sciencedirect.com/science/article/pii/S0362028X23062294. 
3. GFSI. "Benchmarking Requirements Version 2024, Part II: Benchmark Requirements Implementation Handbook." Benchmark Requirement 4.9 and Table 1. December 2024. https://mygfsi.com/wp-content/uploads/2024/12/Benchmarking_Requirements_v2024_Implementation_Handbook_Part_II.pdf. 
4. International Food Safety & Quality Network (IFSQN). "GFSI Unlocks Benchmarking for BMRs v2024 with New Governance Framework." December 9, 2025. https://www.ifsqn.com/forum/index.php/topic/49812-gfsi-unlocks-benchmarking-for-bmrs-v2024-with-new-governance-framework/. See also: Derington, J. "GFSI Benchmarking Requirements 2024: What It Means for You." FSNS Certification & Audit. February 19, 2025. https://fsns.com/gfsi-benchmarking-requirements-2024-what-it-means-for-you/. 
5. Stevenson, C. "Addressing the Workforce Shortage in Food Safety: A Critical Challenge for a Secure Food System." Food Safety Magazine April/May 2025. https://www.food-safety.com/articles/10314-addressing-the-workforce-shortage-in-food-safety-a-critical-challenge-for-a-secure-food-system. 
6. GFSI. "GFSI Sets First-ever Benchmarking Requirements for Food Safety Auditor Training and Development to Boost Take-Up of Critical Role." Press release. November 4, 2021. https://mygfsi.com/press_releases/gfsi-sets-first-ever-benchmarking-requirements-for-food-safety-auditor-training-and-development/. 
7. U.S. Food and Drug Administration (FDA). Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food. 21 CFR Part 117. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117. (Note: Including the definition of "qualified auditor" under supplier verification provisions.)
8. Cwikowski, M. and T. Kahraman. "Why a Paradigm Shift is Needed in Food Safety Auditing." Food Safety Magazine February/March 2023. https://www.food-safety.com/articles/8324-why-a-paradigm-shift-is-needed-in-food-safety-auditing.

Further Reading

• Norton, R.A., M. Sachs, and C.A. Young. "A Future View of AI-Enhanced Biosurveillance and Comprehensive Food Safety Programs." Food Safety Magazine December 2023/January 2024. https://www.food-safety.com/articles/9110-a-future-view-of-ai-enhanced-biosurveillance-and-comprehensive-food-safety-programs​.
• Norton, R.A., M. Sachs, M. and C.A. Young. "Cognitive Security, a Growing Concern for Food Safety: Part 6." Food Safety Magazine August/September 2025. https://www.food-safety.com/articles/10630-cognitive-security-a-growing-concern-for-food-safety-part-6.
• FDA. "Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption." Federal Register 89, no. 88 (2024): 29618–29702.​ Link:  https://www.federalregister.gov/documents/2024/05/06/2024-09153/standards-for-the-growing-harvesting-packing-and-holding-of-produce-for-human-consumption-relating 
• Guiterrez-Rodriguez, E. and A. Adhikari. "Preharvest Farming Practices Impacting Fresh Produce Safety." Microbiology Spectrum 6, no. 2 (April 2018). https://pmc.ncbi.nlm.nih.gov/articles/PMC11633564/.​
• Flach, M.G., O.B. Dogan, M.F. Miller, M.X. Sanchez, and M.M. Brashears. "Comparison of Three Preharvest Sampling Strategies to Monitor Pathogens in Cattle Lairage Areas." Journal of Food Protection 87, no. 4 (April 2024): 100425.​ https://pubmed.ncbi.nlm.nih.gov/38428462/. 
• U.S. Department of Agriculture (USDA). "Understanding Pre-Harvest Routes of Fresh Produce Contamination in Soils." National Agricultural Library, Food Safety Research Projects.​ 2013. https://www.nal.usda.gov/research-tools/food-safety-research-projects/understanding-pre-harvest-routes-fresh-produce.
• Rood, L., C. Kocharunchitt, J. Bowman, et al. "Potential for in-field pre-harvest control of foodborne human pathogens in leafy vegetables: Identification of research gaps and opportunities." Trends in Food Science & Technology 158 (April 2025): 104928.​ https://www.sciencedirect.com/science/article/pii/S0924224425000640. 
• Norton, R.A., C.A. Young, and D. Gerstein. "Bringing New Technologies to Bear for Biosurveillance." Food Safety Magazine April 23, 2024. https://www.food-safety.com/articles/9424-bringing-new-technologies-to-bear-for-biosurveillance.​
• Norton, R.A., M. Sachs, and C.A. Young. Food Safety Magazine. July 2, 2024. "Two Tools for One Health and Biosurveillance." https://www.food-safety.com/articles/9590-two-tools-for-one-health-and-biosurveillance.