Audit Expectations for GFSI Audits: A Personal Perspective and Approach

The adoption and use of Global Food Safety Initiative (GFSI) food safety audits have presented manufacturing companies with an interesting challenge not experienced since the early 1990s. Before 1990, the primary food safety approval activity was the Good Manufacturing Practices inspection. Then in the late 1980s and early 1990s, the ISO 9000 Quality Audit Process was popular, followed by a resurgence of HACCP. The GFSI-type food safety audits started with the British Retail Consortium (BRC) in the middle to late 1990s, then, with that popularity, other food safety audit schemes were developed, benchmarked by GFSI, and adopted around the world. The outcome since 2000 is that the GFSI audit process is the fastest growing global food safety evaluation activity.

GFSI food safety audit schemes or standards were developed using ISO concepts (9000, 17021, referencing 17025, 19011, 22000) and HACCP (CODEX Alimentarius 4), in addition to the scheme owner’s opinion of what makes an effective and comprehensive audit. Stakeholders and businesses such as retailers, manufacturing companies, distribution centers, warehouses, and regulatory agencies have offered input about the content of each audit scheme.

The aim of this article is to compare how the “new” GFSI is different from the more long-term GMP inspection and how it can cause confusion in the execution of a GFSI-benchmarked audit.

Inspection and Audit. The terms inspection and audit are often used interchangeably, but they have distinctly different meanings, which results in confusion between the auditor and auditee. Prior to the late 1980s, the premier food safety activity was the GMP inspection, an evaluation of a facility’s compliance to the GMPs during a defined period of time with little emphasis on the historical documentation. Adoption, use, and competition of the ISO-type audit in the late 1980s and 1990s brought a change to the term from GMP inspection to GMP audit, but with little change to what was actually performed. An audit is an evaluation of historical documentation with little emphasis on current conditions unless there are obvious physical situations affecting product risk. This change in terminology and activity causes misunderstandings between auditor and auditee, and causes plant personnel to misunderstand what is required for program development, implementation, and maintenance.

Inspection. The first few versions of many GFSI-benchmarked standards required more time for documentation review as opposed to actual time spent in the operational areas. This documentation review was performed in a conference room or office. The intent was that if the documentation (procedures and evidence of implementation-performance records) were accurate and notations genuine and legible, then an objective opinion of historical product food safety conditions could be determined. If the food facility was compliant with the audit standard, then the product would meet customer, regulatory, and food safety requirements as presented to the customer or consumer. Furthermore, if the documentation described above was compliant with the standard, the product’s food safety condition could be predicted if the food facility continued implementing or improved the food safety programs. This approach is adopted by many organizations and does have credibility if a food facility follows this concept.

Some argue that that documentation can be fabricated, but “eyes” in a plant will describe current conditions as they exist, so an inspection report of physical conditions has more credibility. However, GMPs are at the root of most food safety issues, so a well-developed program that passes inspection shows that a food company complies with food safety regulations and is committed to doing all it can to provide clean, safe products.

Both opinions of inspection and audit are correct, but have different approaches and assessment outcomes. Consequently, the best and most comprehensive food safety plan is to have a functional balance between the two activities. Most recently, GFSI standards have enhanced requirements to increase the amount of time an auditor spends in the operational areas evaluating the physical condition, as well as the records and procedures being implemented, and decrease the time spent in the conference room evaluating procedures and historical records. This results in more observations being noted and non-conformances being assigned. The various GFSI-benchmarked standards have explained their guidance for rating GMP-type observations in their guidance documents. Auditors must follow this guidance, not a company’s stance or their own personal opinions. Also, the rating system that includes GMP-type non-conformances must be followed.

Standard rating systems do not distinguish between document, record, or GMP-type non-conformances and, as a result, some facilities are experiencing more non-conformances and lower scores and ratings. Auditors have different education, experiences, and trends that will manifest their tendencies during the floor evaluation. The way that auditors evaluate GMP conditions can differ between auditors in the same certification body. Some GFSI standards allow only 30 minors for the lowest score, with 31 or more resulting in no certification. One major usually equals 10 minors. To help sort it out, facilities can review their last internal GMP or third-party inspection and tabulate the observations that were considered minor or major, then compare those to the GFSI standard rating system. This exercise will provide a good insight to the GMP-related non-conformances that could be assigned if observed during an audit and the impact to the overall audit score and rating.

Audit/Auditor Conduct. GFSI is very clear about how an auditor must perform the audit. The auditor must follow rules that are specific to GFSI and the standard owner, with which many facility managers are not familiar. Some auditor requirements are consistent with “Auditor Code of Conduct” as mandated by the standard owner, some are consistent with the certification body requirements, and some are consistent with ISO 19011. Certainly, the auditor must explain the audit plan during the opening meetings, but the manner in which the audit is performed is usually the point of differentiation since it is not the same as a GMP inspection. Auditors have latitude in how they perform the audit regarding what is looked at first. They can jump around the standard or proceed from the top down. Facilities often remark that two auditors performed the audit totally different.

This differs from the way most GMP inspections are performed. Usually auditors look at the equipment and overheads first. They start at receiving and proceed through distribution. There is some degree of predictability, but that is not so in GFSI audits. First, the GFSI auditor is not allowed to provide guidance and suggestions for corrections of non-conformances identified during the audit. Non-conformances must have corrective actions submitted and approved by the auditor and certification body; if an auditor provided guidance and the facility followed it, the auditor would have no option but to approve the corrective action. This situation is a conflict of interest and is prohibited. For that reason, the auditor must explain the reason for the non-conformance, but cannot give corrective advice. If plant management presses the issue and continually asks for advice and the auditor refuses, management many times perceives the auditor as being uncooperative, impersonal, and, in some cases, unprofessional. In reality, the auditor is following the rules and has no choice.

Audit/Auditor Approach. As with GMP inspection tendencies, auditors have a comfortable method for performing the audit. Some certification bodies provide specific instructions for audit conduct, but allow for auditor style. Regardless of these, the GFSI standard must be assessed as it is intended and the auditor must assess each clause and section. The assessment must assign “Compliance” or “Non-Compliance” to several requirements. These requirements include GFSI standard requirements, food safety regulations (i.e., 21CFR part 110 or regulated HACCP), food safety requirements (individual program details for compliance with regulations, such as components of a pest control program including EPA requirements for pesticide use), customer requirements, and legal requirements (e.g., site registration).

Auditors are expected to assess the standard as it is stated and there is usually a guidance document to assist auditors. GFSI standards are specific about what needs to be done, but very generous on how to accomplish the requirements. Compliance or non-compliance is determined first by the standard clause requirements and then by the guidance document. When an observation is clearly not compliant with the standard clause as written, the auditor will assign a non-conformance and then decide on the severity based on the standard definitions of severity. If there is a question of compliance, the auditor should consult the guidance document for clarification. Again, the auditor must use the standard clause statements and the guidance document for decisions, not his own preference or opinions. Auditors must decide on compliance to a clause requirement as well as where it falls within the definition of severity as defined by the standard owner.

Occasionally and inappropriately, some auditors will give more leniency by either not recording non-compliant observations or not assigning appropriate severity within the standard definitions. However, since the clauses are very specific by design, with many clauses using words and phrases such as shall, must be documented, contain as a minimum, based on risk assessment, etc., there is little latitude for auditor interpretation of compliance or non-compliance. Again, the auditor must see evidence of documentation or performance when these words are used, or they are not following the requirement of the standard and not performing an adequate assessment.

All programs of GFSI standards require at least the following components: procedures, performance records, training records for the personnel performing the tasks, document control, and record notation requirements. The only way an auditor can assess performance is to review the performance records or observe actual practice in the plant for compliance with the company procedures. If the auditor observes practices in the plant that are not consistent with the company procedures, the auditor has the latitude of documenting the observation as a non-conformance and then assigning severity based on the standard’s definition. Keep in mind, when a clause uses the words stated above the auditor only needs to see any evidence of non-conforming activity to be appropriate in noting a non-conformance. This is another area where plants can have differences with auditors. In some situations, plants have had established procedures for years and even decades and previous auditors have been satisfied with them. Then GFSI auditors audit to the GFSI standard and they are not accepted due to the specificity of the standard requirements. If some component of a procedure is missing or there is performance in the plant that deviates from the standard requirements, there is justification for non-conformances. On occasion, plant staff will attempt to convince the auditor that the company procedures have been in existence and approved for years, and question why they aren’t now. They may become frustrated when the auditor does not accept the argument. Again, the auditor has no choice, he must audit to the standard.

Conclusion. GFSI-benchmarked food safety audits are different than traditional GMP inspections, both in content and approach. Auditors must evaluate facilities according to rules and Code of Conduct mandated by the standard owners and must audit to the standard. GMP inspections can be flexible depending on the type of facility, the specific risks identified by a company, and the current food safety capability of the facility. GFSI auditors are considerably more restricted in performing the GFSI audit.

It is important that plant management become familiar with the GFSI-benchmarked standard used at their facilities through self-study, training courses, consultants, etc. so they are educated about what needs to be done for compliance and continued management of the food safety system. Also, realize the auditor has little latitude when evaluating what is required because the standards are clearly defined.

Certification bodies must ensure GFSI auditors have the education, industry experience, aptitude, and training to perform these audits. It is important to ensure there is a process improvement to facilitate audit consistency and adherence to the standard owner’s expectations. As time progresses, if an organizations chooses a GFSI-benchmarked scheme, it is expected that all players will become more accustomed to the GFSI audit process, what is required for compliance and auditing, and how it must be performed, as well as our individual roles and responsibilities.

The author is Director, Food Safety Education, AIB.