Audit Scores: Setting a False Sense of Security?

In theory, the Global Food Safety Initiative (GFSI) is a solid system with schemes that can help assure food safety in facilities in which it is implemented. But, in practice, its passing audit scores and ratings may advocate a false sense of security that our food is safe. It’s not that the standards or schemes aren’t sound; rather, there are just too many variations and issues in the application of the schemes by the certifying bodies. At times it is evident to me that high scores are being given for below regulatory compliant facilities. And because many in the industry, including both customers and processors, depend on these scores as an indicator that the ingredients or products they are receiving or distributing are safe, there needs to be a higher level of confidence in their accuracy. There needs to be accountability.

THE ISSUES. To provide a few facts and examples of what that entails: When I’ve visited facilities that were just audited to a GFSI scheme and inspected them to the same criteria — it appeared several times that they were given high scores in areas in which they had minor or major non-compliances and even critical failures. It may have sometimes been that the facility verbally responded to the auditor on their procedures and programs, and that satisfied the auditor without having written documentation. I say this because, at the time of my visit, no detailed written program existed or I found an incomplete or inequivalent written program. Thus, a GFSI scheme certification may not actually validate that a facility meets or exceeds requirements for having a documented and validated food safety and food defense program in place.

Sometimes this may be due to the auditors’ lack of knowledge and understanding of the process hazards that they are auditing so they don’t know what or how to inspect the hazards. But, if this is the case, it needs to be corrected as it causes a lack of consistency for certifications, leads to passing scores in areas where a facility actually has non-compliances — possibly even critical failures, and results in the false sense of security that the food process is safe.

While I have heard executives of other food industry segments express similar sentiments, my experiences lie with seafood, and I’m seeing auditors in the plants who may have limited or no training or experience in seafood HACCP. They may look at the documents and see that there is a hazard analysis and a corresponding flowchart; what they may not see is a very weak and incomplete hazard analysis that doesn’t address all the potential hazards — because they may not know that the hazards themselves exist. They may not be checking the FDA Fish and Fisheries Hazards Guidance Manual, validated science references, or industry research to see if it addresses the many possible hazards including, but not limited to, Clostridium  botulinum, scombroid toxin species-specific hazards as in Histamines, properly controlled and labeled allergens, or how the most critical food safety and food defense of the seafood is achieved. They may not know to do so.

There was even one supplier to which I was exposed that was receiving top scores on successive certifications, but when product was tested microbiologically, it tested positive for harmful pathogens. Accepting a GFSI score at face value may put various consumers at risk — along with brand name reputation and the business as a whole.

We all know that FDA compliance relies heavily on documentation — If it’s not written down, it didn’t happen. But we also have to ensure that what is written down is actually being done: Simply put: 1) Say what you do; 2) Do what you say you do; 3) Prove it. While the plants getting high scores may have been saying what they were going to do, there was no proof or evidence that they were regularly doing it. And in the case of the supplier in the previous paragraph they were not doing what they should have been doing.

Unfortunately, I’ve also found that while it is possible to contact the scheme owners and report such issues, I’ve not found it to have much in the way of results — with the same plants getting the same unearned high score from potentially the same auditor the following year. And I may be one of the few who made such a report, because there are likely not many companies that will self-inform and risk the chance of their score being lowered or, perhaps, their business jeopardized.

On the other hand, there is a certain lack of objectivity in the fact that the certifying bodies are businesses that want to do repeat business. A failing mark on a critical issue may lead that plant to lose customers — and to change certification providers as well. The plant may make the corrective actions, but then find another certifying body the following year who may not be as meticulous or knowledgeable. Consider this — If a certification body fails a processor, would the processor call them back again?

POSSIBLE SOLUTIONS. So what can be done to address these issues and more, and rid us of possible false security? Perhaps it is as simple as adding more accountability to the authorities, the certified schemes, the certifying bodies and certifying auditors. For example, random reviews could be conducted by the GFSI certification schemes. A high-level, non-certification body auditor — with knowledge in the specific industry segment — could regularly or periodically analyze audits, asking questions of the auditors, and digging deeper into responses, also possibly requiring verification of the program in part.

Auditors could (and should) receive more in-depth training on the specific hazards and processes of the product/industry segment that they inspect related to HACCP. If they are not qualified in that species or genus, they should not be certifying a facility. Additionally, a different auditor could be required for each year’s audit. Perhaps an auditor may audit a specific facility every other or every third audit year. It is important to extensively review the previous audits, but starting fresh may be required.

It has appeared to me that after a particular certifying body audits the first year, it may be “cut and paste” for anything that appears to be the same or for which they are told it “hasn’t changed.” It may be more beneficial to have a different auditor and a blank slate used each year.

Auditing is an intensive, exhaustive, time-consuming activity requiring the uncovering of minute details that may find problems that need correcting. And that is exactly why audits can help ensure food safety. But if the auditors don’t have a complete familiarity with the processes, products, species, etc. that they audit; if they are not searching for and logging issues, corrections may not be made, and we may not have safe food.

We all must be held accountable — from the plant personnel to the auditors to the certifying bodies. If we don’t hold ourselves accountable for ensuring that we’ve done all that we can to keep food safe, we may be held accountable too late when the lack of safety and integrity causes illness or ultimately death.

Bobby Love Director, Global Food Safety, Technical & Regulatory Affairs, Phillips Foods, Baltimore, Md.