Audit vs. assessment
March 13, 2017
by Len Heflich
As the result of the Food Safety Modernization Act (FSMA), the Food and Drug Administration (FDA) is moving from an inspection mode of action to an assessment model. If this sounds like semantics, be assured it is not.
Under an inspection model, a food safety inspector checks for compliance against a specified list of expected practices, behaviors and results. The list is well-defined and fairly easy for a trained and experienced inspector to review and compare what they find in a food manufacturing facility to the standard and determine compliance or deviations. They then document the deviations and expect the manufacturer to take corrective actions and document them as proof until the matter is closed.
There are some benefits to an inspection model. The expectations are clearly defined and change slowly with plenty of warning for manufacturers and inspectors. Compliance is easy to determine and achieve.
There are, however, several problems. Compliance is only confirmed at the time of inspection. If the expectation was out of compliance yesterday but corrected before the inspector arrived, no failure to comply would be detected. If a failure was detected and then corrected tomorrow, there is no way to ensure compliance will continue into the future.
Inspections are like a snapshot. They take place at a specific moment and only confirm compliance at that point in time. They cannot ensure compliance over an extended period. In addition, inspections are only as good as the inspector. An experienced inspector may know where to look for compliance failures, but even an experienced inspector can overlook one, especially if someone in the plant takes some quick steps to hide it. Passing the inspection becomes the objective, as opposed to having an effective food safety program that affirms extended compliance.
Under an assessment model, an auditor reviews a food safety plan, where manufacturers have evaluated the food safety risks of their ingredients, process, programs and finished products. Since operators know the most about their process and end products, they are the best to perform the risk assessment. They identify controls and programs to manage, mitigate or eliminate the food safety risks. They validate that their controls are effective. They verify and document that the validated procedure has been performed as designed. They train their employees to perform the control steps, to identify failures and take effective corrective actions.
The auditor, during the assessment, will review the food safety plan and look for several key elements. Does the plan contain a comprehensive food safety risk assessment of the entire process? Does the plan contain controls to maintain food safety and prevent failures due to the identified risks? Does the plan identify effective corrective actions to be taken in case of a failure to manage, mitigate or eliminate loss in the event of a control failure? Are procedures documented, validated and verified when performed? Are employees trained on relevant parts of the food safety plan? Is there a program to manage vendors and contract manufacturers? Is there a program to test for and manage the presence of pathogenic microorganisms in the facility? Does the plan contain a food defense risk assessment with identified controls and corrective actions to take in the event of a failure?
Under this model, the risk assessment has been performed by people who are the most knowledgeable about the specific process and finished products.
Adherence to the identified controls and corrective actions via established programs ensures that food safety compliance is in place now and into the future. Passing an assessment demonstrates that the food safety plan is well developed and executed and can guarantee extended food safety.
Unfortunately with an assessment model, determining the adequacy of the food safety plan is difficult without intimate knowledge of the manufacturing process and the finished product. It’s possible for an inexperienced auditor to miss serious gaps in the plan or require a manufacturer to perform unnecessary steps.
If the plan is executed improperly, it’s possible for failures to go undetected or unreported. Such failures could be difficult to detect if they are hidden due to incompetence or intent. Lastly, it is difficult to train auditors to assess food safety plans because they need to be specifically tailored to different processes and finished products.
FDA is not the first to move from an inspection model to assessment. AIB International championed the move with its Gold Standard Program 20 years ago. GFSI has taken this approach in fostering the development of audit schemes such as SQF, BRC and FS 22000. The industry started the move to assessment with the expansion of food safety risk assessment beyond HACCP.
This is a necessary next step in the evolution of food safety practices.
Editor’s note: Len Heflich recently retired from Grupo Bimbo where he was vice-president of food safety, quality and crisis management. He has worked in the food industry for 42 years, 34 of them in baking.