The Difference Between a Food Assessment vs. a Food Audit

It is important to recognize these differences between the purpose and performance of an audit and that of an assessment. In my opinion, the purpose, importance, and structure of an audit has been over-emphasized in the determination and control over given risk/threat identification in food production and food manufacturing environments. More emphasis needs to be placed on performing a comprehensive assessment that is not taken from a “checklist” of generally well-known issues and concerns.

We have become overly reliant on the conclusions of auditors and their audit results. Peanut Corp. of America (i.e. Salmonella) and Jensen Farms (i.e. Listeria monocytogenes) are two memorable industry public health events with root-cause failures that were not identified through audits performed by highly regarded auditing firms. Audits professionally performed by third parties preceded these unfortunate events, and generally high audit result scores were issued to these firms.

In these unfortunate industry system failures, the auditors missed the use of substituted contaminated product washing and cooling equipment, poor technical assumptions, and erroneous validation and verification data. It is difficult to always identify where these unidentified and unrecognizable hazard/risk/threat gaps may latently linger, unaddressed, in a food safety or food defense (and EMA) plan unless a well-structured hazard/risk/threat assessment is performed.

The way in which FSMA rules are written has strengthened the expectations and requirement that the hazard/vulnerability/threat and control/mitigation identification will be more comprehensive than in the past. These assignments must now be thoroughly deliberated by the facility Food Safety and Food Defense Teams. Decisions to include (or not to include) a hazard/risk/threat/mitigation must now be formally justified and a part of the written facility all-hazard food protection plans. This will go far to help ensure that expert food defense-qualified individuals have enough education, experience, recognition, and training for any facility vulnerability assessments that will be performed to support the specific activities within a Food Defense Plan.

An Outside Eye

If your facility is relying solely on a food defense or GFSI-style certification program owners approach to perform this assessment activity, I would again caution management not to rely upon an audit list alone. Instead, invite other outside competent individuals, not familiar with your facility and operational activities, to assist in an assessment activity.

When I performed food defense and food fraud facility vulnerability assessments, I heard facility employees who were shadowing me during my visit say numerous times, “I never noticed that” or “We don’t have a procedure for that.” During one food defense and food fraud vulnerability assessment walk-through, a manager said that “it never occurred to me that our raw packaging and packaging waste materials could be used to counterfeit our products.”

Several years ago, I was challenged by a large food manufacturer to penetrate one of their facility’s food defense systems, which were, according to their corporate physical security manager, considered to be “the best product protected security site within our manufacturing group.” Unfortunately, it was surprisingly easy to defeat the facility perimeter defenses, enter the facility from the outside, and then move unseen into the production area with exposed product through unused and unlocked dark office space. This was accomplished during normal business hours.

The point from these observations is that there is no perfect site-specific audit instrument that will accomplish what a true assessment can deliver to help safeguard product security. Prior to performing a more thorough assessment, these mentioned facilities used industry and/or government food defense audit templates to measure their own product security readiness. But, in doing so, these facilities failed to identify several of their later-proven site-specific and potentially catastrophic product security vulnerabilities. Assessing food defense system vulnerabilities after hours is another way to observe potential system failures. At these times, there is less supervision, more unrestricted access to product, packaging materials, and rework. Materials are often unsecured, warehouses are lightly manned or un-manned, and generally, fewer employees are onsite in sensitive production areas, often when contract night or weekend work occurs.