Third-Party Auditors Rule: Are You Left Out of the Reporting Loop?

Serious Violations Must be Authenticated

When a potential critical nonconformity is observed by an auditor performing a regulatory/certification audit, he should have internal technical support to ensure the finding is accurate and contains the complete facts of the situation. He should not be alone in making such a key decision—a meeting with all stakeholders during the audit is often used to address this need.

In our example, the CB and the auditor reviewed the entire process flow and determined the area of the insect activity was the initial preparation step of the raw fruit in a separate, isolated area designed for that purpose. The plant manager explained how the fruit was subjected to a series of rigorous washing and sorting steps in an adjacent facility and this was observed by the auditor to be well cleaned before beginning the heat processing. All agreed the washing/sorting process was adequate to control insect contamination and there was no critical nonconformity.

During this process, the plant still has Reportable Food Registry (RFR) obligations that are now complicated by the auditor/CB reporting process. For example, the RFR only gives the facility 24 hours to evaluate and report, so what is its responsibility here? Should it wait until the CB completes the review and officially reports to FDA, then file RFR? Suppose the CB doesn’t complete the review in time? Is it in fact faced with violating RFR obligations by the new reporting requirement?

Thankfully, this case happened before the proposed rules were published. The CB had a standard procedure to follow that included review of all relevant facts and the plants’ input on process and procedures. The audit was completed and certification was granted. Had the initial finding been correct, FDA would know when certification was suspended or denied. Would anyone, FDA included, have been better served by reporting incomplete or incorrect information to FDA before notifying the plant personnel as would be required in the proposed rule? The answer is no.

If this had been a consultative audit, the auditor should observe and document how the plant handles the situation. Does it identify affected product and isolate it promptly? Are procedures followed for correcting this situation? Are the corrections adequate to prevent the situation from happening again? Does it accurately determine if product is potentially in commerce, which would need to be removed and reported? If necessary, does it file an RFR in a timely manner?

Now it would also require the auditor/auditing company to report to FDA. But the consultative auditing company may not have any review procedures. The proposed rule isn’t clear on what the requirements are, if any, for an unaccredited auditor/auditing agent performing a consultative audit, so in reality this could be just one auditor acting alone. If so, is she obligated to report?

For arguments sake, let’s say this is simply one individual, so the auditor stops the audit and files the report to FDA, letting the plant know afterwards what has been reported. After all, a statement that insects were observed on raw materials and product is serious and should be acted on promptly, right? Wrong! The finding was never reviewed prior to finalizing and reporting and the plant didn’t have a chance to explain its processes. The auditor alleging the violation may/may not have the training or experience sufficient to make this decision alone. Ultimately, the finding would be proven to be incorrect, but the legal and liability issues would be messy to say the least.

Unless every auditor/audit agent performing consultative audits are operating under all of the accreditation requirements, their findings and auditing methods are not validated and should not form the basis of any official reports to FDA. There is no value in directly reporting information that is incomplete or has not been vetted.