Lessons Learned from GFSI Audits

The organizational structure: Companies are constantly changing, and organizational charts should be updated accordingly. New managers, new positions, or new structures are not always translated immediately into the organizational charts. Some standards also require job descriptions; have these readily available and updated if needed. Document the backup plan for key positions.

Customer focus and complaints: For the standards addressing food safety and quality, an organization must build performance indicators related to customer satisfaction. Although customer satisfaction monitoring is not hard science, some metrics can be implemented, such as traditional surveys, credit notes, order fill, or market share. Whichever standard is chosen, make sure that customer requirements are communicated and implemented throughout the entire operations process. Keep a record of complaints, your investigations, and how you have communicated with your customers and consumers.

Internal audit: Some standards require that every department be audited internally once a year. Make sure all departments impacting food safety or quality are included in your internal audit schedule. Ensure that auditors are independent from audited activities. For smaller companies, the support of a consultant can be the solution. For a larger corporation, an outside auditor can bring an objective look, as well as deep knowledge of your processes.

When we review internal audit reports, the corrective action definition and follow-up are sometimes missing. Once the internal audit is performed, allow reasonable time to define corrective action and follow-up accordingly.

Purchasing: Vendors play an important role in ensuring food safety, but organizations often lack defined criteria for vendor selection and ongoing evaluation. Some standards also require defining a trial period for new vendors. Include these points in your documentation.

Documentation: Documentation can help prevent findings, especially when a robust control system and thorough internal audits are implemented. Most issues are related to missing or outdated product specifications (including packaging, raw materials, and chemicals). Good internal communication will ensure that any change in vendor/recipe is widely communicated internally. Some standards also require that document changes be recorded, with documentation explaining procedure modifications. Describing what has changed compared to a previous version is not sufficient; you must include the reasons for the change.

Corrective and preventive action: Corrective or preventive actions are often implemented but are not documented or tracked for efficiency. Implementing the action is more important than recording it, but keeping good records ensures a documented history of solved issues and can help maintain knowledge within the company.

Traceability: Ensuring traceability is often required in the regulations, but GFSI standards require more. Packaging material traceability is often overlooked and can be difficult to implement when packaging materials do not have an easily accessible batch number. Discuss this topic with your packaging vendor to make sure you record the right data. Note also that some standards require mass balance checks, a powerful tool to test the reliability of your traceability system. Finally, reworking the product should not jeopardize traceability.

Incident, withdrawal, and recall: Being ready to manage a crisis requires a detailed and updated procedure that is regularly tested. This document should include an up-to-date list of key contacts—internal, authorities, customers, and even the certification body for some standards. Understand the FDA’s new food registry, which has been designed for these kinds of issues. Your records should include any conclusions about withdrawal testing results, whether you were satisfied, and where improvement is needed.

HACCP Issues

The cornerstone of a robust food safety system, HACCP documentation and its implementation, is being scrutinized by third party auditors. Certification body auditors will focus more on the implementation than on the documentation, but both are needed.