A Practical Guide to Key Global Food Safety Initiative Concepts

Once you commit to implementing the Global Food Safety Initiative (GFSI) scheme of your choice, there are several concepts that you probably have begun, but not to the level that will be required. The best way to be successful is to identify the core concepts, understand what each concept consists of, and identify why it is important for implementation.

Internal Auditing. Internal auditing is required by all GFSI schemes and is a method of measuring where your quality system is in relation to the requirements of each standard. It involves performing internal GMP inspections and looking at your procedures to determine if they cover everything that is required. It makes you look at your records and ask if the information collected proves that the given procedure was followed as written. Finally, it has you ask, “Do I have an effective program in place?”

Internal auditing is most successful when scheduled in advance and organized in a way that allows each section of the standard to be grouped together. For instance, in SQF, an Internal Audit on Warehousing could include 4.4.5 – Incoming Goods and Services; 4.4.10 – Stock Rotation; 5.4 – Storage Facilities; and 6.11 – Transport and Delivery. A reasonable amount of time for each audit would be two to four hours.

Internal audits should be performed by a trained internal audit team, led by a lead auditor. The lead auditor should not audit against his/her own area of responsibility. Each audit should have a designated auditee, who is the department head of the area being audited. An internal audit should be planned in advance and follow a plan. Internal audits are also a time to go to the floor and interview relevant employees to determine how effective the training program is. The floor inspection and interviewing is normally conducted by the team auditor(s), who are there to assist with the audit.
 

HACCP. Has your HACCP team been trained recently? Have you had your HACCP plan reviewed by a third-party certification audit? Do you use HACCP to make decisions before new products or equipment are allowed in production, or do you just try to keep the plan updated to what the facility is doing? Is the HACCP team truly multi-disciplinary, or is it just one or two people trying to do it by themselves?

All GFSI schemes are based on an effective HACCP plan that identifies all potential food safety hazards. Some of the schemes also have you identify all of the product quality hazards that can affect your products. Once the hazards are identified, you must decide if you are controlling the hazards (prerequisite programs) or have the opportunity to eliminate the hazard in a process step. Next, you identify procedures and records that will provide evidence that you are maintaining control of the hazards.

Finally, the GFSI scheme expects that you have control of your operations. That means the employees that you train to operate the line are also responsible for monitoring the control programs, adjusting them as required, and properly recording the details of each program as they happen. In other words, as written and trained, your quality system should be capable of identifying when things are going wrong and making the adjustments to bring the issue back in control.
 

Communication is Key. Continual improvement is the result of effective communication to relevant staff of all identification of corrective actions, verification of the their effectiveness, and results of internal audits. Other items that have to be communicated on a regular basis include customer complaints, deviations from critical control points, deviations from prerequisite control programs, issues with approved supplies, identified food safety incidents, internal GMP inspection summaries, quality issues, product evaluations, food safety and product quality objectives, pest control issues, and regulatory or industry changes that might affect your business.

Facilities have to get in the habit of having regularly scheduled meetings specifically for the purpose of discussing their GFSI scheme, and not just as five minute add-ons to a production meeting. Also, if these meetings are not properly documented, they really didn’t happen in the eyes of GFSI.

The Role of Leadership. All GFSI schemes require leadership and accountability that will drive the facility’s path to successful certification. There is no easy button for GFSI. It forces each department to become more organized and do a better job of documenting and recording daily activities. Each department will be informed and trained to their responsibilities and be held accountable if they fall short of achieving these.

TRAINING. In general, food facilities are very good at getting workers to the floor in a timely manner, getting them acclimated to the GMP rules, and getting them working. GFSI forces identification of the skills and competencies that workers need and a sign off that workers were effectively trained to these before being allowed to start working. It is the responsibility of senior management to ensure that all employees have been effectively trained in food safety and product quality issues. A well-organized training matrix will provide better proof that the training was done and could prevent any workers from slipping through the cracks.

Whether personnel are employees of the facility or temporary employees from a staffing agency, the requirements are the same. It is not acceptable for a facility to push all training of temporary employees to the staffing agency.
 

Documents and Records. All GFSI standards require that a facility organizes its QMS into policies, programs, procedures, work instructions, and records. A policy is generally a statement from facility management about what is important to the company. For example, senior management will commit the required human and financial resources needed to conform to all the clauses of the appropriate standard.

Programs, usually identified as prerequisite programs, are minimal food safety control programs that are put in place to prevent all identified food safety hazards. A program can have several components that work together to control a single hazard, or can be a stand-alone component that controls more than one identified hazard.

Procedures are the written instructions that identify the purpose, scope, and responsibility of any given activity that occurs in the facility. A properly written procedure should be used as a method of training for worker competency.

Records are the information that has been collected on the floor in real time. Keep in mind, if there is a requirement for a procedure, it means a record will be provided to ensure that the procedure has been carried out correctly. Sometimes, however, one record form may be used for collecting information from more than one written procedure. All documents have to be identified and correctly authorized, and all records have to be maintained and stored for a required time.

Corrections/Corrective Actions. These two words are often used interchangeably, but they have quite different meanings.

Corrections are a reaction to a noted deficiency; they are normally done in a very short time period. For instance, during an inspection of the facility, the food safety team notices a hole in a wall of the warehouse. They notify maintenance and the hole gets patched that evening. In other words, a correction only addresses the symptom that was identified.

A Corrective Action would have required the team to analyze the root cause of the hole in the wall and put a plan in place to prevent this from happening again. Root cause is determined by a 5-Why Procedure or a Fishbone Decision Tree. These are management tools that help identify the real reason the issue occurred. A corrective action does not address the fact that the hole has to be repaired, but rather ensures that the forklift operators receive effective training so they won’t cause another hole from occurring.

Preventive action is a corrective action that has been put in place to a hypothetical issue. For instance, a guardrail could be identified as being needed in the warehouse to prevent operators from getting too close to the wall, so they can’t put a hole it. This can be put in place even if there has been no issue of holes occurring.

GFSI requires you to track corrections and corrective actions. GFSI also requires, at some point in the future, that all corrective actions have not only been verified complete, but also verified effective.

24/7/365. GFSI requires a lifelong commitment to the stated requirements of the standard. It is not like a GMP audit where the facility can be shut down for a long weekend for deep cleaning and made presentable for an auditor. Records have to be maintained, monitored, verified according to the stated frequency of the facility, and properly stored. Internal audits have to be completed according to the schedule which is most effective if they are scheduled throughout the year. Corrective actions have to be followed up with and communicated to relevant staff. If re-training is required, per the corrective action, it needs to be followed up to make sure it occurs as planned.

Since GFSI never stops, a facility has to have provisions in place to continue to operate when key employees get take vacation. This means there have to be stated replacements for key employees when they are not at work, most notably for the food safety leader and department heads.
 

Three Key Steps. Monitoring is a real-time indication that a procedure was carried out as required. A properly monitored record identifies the person and time the check was completed. Employees who are responsible for monitoring should be trained as to what their initialized signature means and how to properly fill out the record (no whiteout, no scribbles, no pencil, no lines left blank, no ditto marks, etc.).

Verification is a statement by a responsible party that the monitored procedure was carried out and determined to be in control. It should be done by a person who has oversight of the monitor, preferably someone who has trained the monitor and occasionally sees the monitor doing his/her job. One thing often overlooked is that it is the responsibility of the verifier to note when the records are not being monitored (filled out) correctly. They have to re-train the monitor to make sure the procedure is being carried out correctly. It does not take the responsibility away from the monitor, but it does share the responsibility. Verification should answer the question, “Did we do what we said we would do?” Once again, it should be shown that the verifier has been trained to the meaning of verification, not just told to sign a bunch of paperwork.

Validation is a statement that what was done was effective. Very seldom can a validation assessment be based on a single input. For example, a validation assessment of a sanitation program would be based on items such as the year-long ability to complete the master cleaning schedule; the lack of complaints against issues that would arise from poor sanitation (burnt pieces in the bottom of the cake or complaints of product that tasted like soap); the lack of chemical control issues noted by in-house GMP inspections; the identification that all members of the sanitation team have been trained to all their required tasks; and the fact that there are no issues with pre-operational approval checks. This validation would normally be part of an Internal Audit, and it should conclude with a judgment as to whether or not the program was truly effective.
 

Summary. The more you understand why these concepts will make you successful, rather than just being told these are things you have to do, the easier the transition to a GFSI certification will be. In general, facilities will have to commit 15 to 25 hours per week to gain certification. This is not just one person, it is a combination of hours dedicated to the food safety team, proper verification and maintenance of records, internal auditing, corrective action follow-up, identified training needs, and management review meetings.

As far as readiness for a GFSI certification, it should be measured in relation to review cycle rather than in weeks or months. That is, you need to go through several internal audits, identify corrective actions, identify any training as a result of the corrective action, communicate the results to senior management, and have senior management communicate back to all relevant staff. This would be one review cycle.

When a facility gets through at least six of these cycles, whether the cycles are two weeks apart or three months apart, they should be getting ready for an audit. This is assuming the cycles get more effective with repetition and at least 40-50% of the internal audits have been completed the first time around.

The author is Manager Food Safety & GFSI Education, AIB International.