FOOD SAFETY ASSURANCE SYSTEMS
28
Audits of Food Safety Management SystemsY Motarjemi, Food Safety and Risk Management Consultant, SwitzerlandS Mortimore, Land O’Lakes, Inc., St. Paul, MN, USA
r 2014 Elsevier Inc. All rights reserved.
GlossaryAdulteration A fraudulent action that is intended to: (i)
omit a valuable constituent or substitute another substance,
in whole or in part, for a valuable constituent; (ii) conceal
damage or inferiority in any manner; or (iii) add any
substance to increase its bulk or weight, reduce its quality or
strength, or make it appear bigger or of greater value than
it is.
Audit A systematic and functionally independent
examination to determine whether activities and related
results comply with planned objectivities.
Benchmark A reference point or standard against which
performance or achievements can be assessed. A benchmark
refers to the performance that has been achieved in the
recent past by other comparable organizations, or what can
be reasonably inferred to have been achieved in the
circumstances.
Compliance The products and/or practices meet
regulatory requirements (to be differentiated from
conformity which means that activities are carried out
according to the established procedures).
Control measure Any action and activity that can be used
to prevent or eliminate a food safety hazard or reduce it to
an acceptable level.
Encyc8
Corporate governance A system of law and sound
approaches by which corporations are directed and
controlled, focusing on the internal and external corporate
structures, with the intention of monitoring the actions of
the management and directors and thereby mitigating
agency risks which may stem from the misdeeds of
corporate officers.
Critical control point (CCP) A step at which control can
be applied and is essential to prevent or eliminate a food
safety hazard or reduce it to an acceptable level.
Good hygienic practice A system of management
controls that need to be adopted at production, processing,
storage, distribution, and preparation to ensure safety and
suitability of products of consumption.
Hazard analysis and critical control point (HACCP)
system A preventive system which identifies, evaluates,
and controls hazards which are significant for food safety.
Validation Obtaining evidence that a control measure or
combination of control measures, if properly implemented,
is capable of controlling the hazard to a specified outcome.
Verification The application of methods, procedures, tests
and other evaluations, in addition to monitoring, to
determine whether a control measure is or has been
operating as intended.
Introduction
Audits (food safety audits) refer to an industry activity to verify
that the food safety management system is implemented
correctly and effectively, and is maintained. The primary
reason for auditing food safety management systems is to es-
tablish whether a food business has the ability to consistently
produce, manufacture, or distribute ‘safe’ food and to ascertain
that the food safety management provides adequate assurance.
Audits may be carried out by a business itself as part of self-
control in which case the audit is called internal audits. It
can also be carried out by an external body such as the cus-
tomer or a certification body, which is then referred to as ‘third
party audit.’
In the framework of the enforcement of laws and regu-
lations, governmental authorities also verify the compliance
of industry practices with laws and regulatory requirements.
This activity is usually referred to as ‘inspection.’ Today, in-
spections follow a similar process as audits and have become
very comprehensive; although they are carried out for a dif-
ferent purpose. For a more thorough review of inspection,
the readers are referred to a specific article on this subject. The
focus of this article is on the industry audit of the food safety
management systems.
Definition and Purpose
An audit is an evaluation to verify that actual practices match set
standards and codes and determine gaps, if any. With advances
of the hazard analysis and critical control point (HACCP) sys-
tem and the integrated food safety management system, the
scope and purpose of audits in the industry have shifted from a
snapshot examination of good hygienic and manufacturing
practices to a more general audit of the food safety manage-
ment systems. Thus, the primary purpose of audits is no longer
for controlling hazards, but for confirming that control/pre-
ventive measures are implemented correctly and are effective.
lopedia of Food Safety, Volume 4 doi:10.1016/B978-0-12-378612-8.00368-1
Food Safety Assurance Systems: Audits of Food Safety Management Systems 289
However, there are multiples reasons for which audits may
be carried out. These include:
1. Confirming the compliance (or identifying the divergence)
with the internal rules and/or regulatory requirements. This
is perhaps one of the most frequent objectives of audits.
2. Evaluating the ability of a supplier or a contractor to pro-
duce, manufacture, or transport a food according to the set
requirements. This can happen when choosing a supplier, a
contract manufacturer, or even purchasing a new business.
3. Investigating violations or incidents, for example, investi-
gating a recurring critical control point-related violation,
employee complaints, alerts by internal whistleblowers,
frequent consumer complaints, or a full-fledged incident.
4. Obtaining a certificate of assurance for the customers that
their requirements are met. This may be with customers
nationally or internationally.
5. Benchmarking or analyzing gaps in view of identifying the
need for improvement, including the need for technical as-
sistance, training and guidance on competences, and/or
improving the infrastructure (equipment, design of prem-
ises), etc. This can happen when a new factory or business is
purchased, or when companies are merged. Experience has
shown that small- or medium-size businesses are often not
resourceful enough to know the regulations that they often
learn about these when they are visited by an inspector or
assessed by a customer or the representative of a certification
body. In such a situation, to avoid conflict of interest it is
important that those involved in guiding the business are not
the same individuals who will also assess for compliance.
Scope and Frequency of Audits
The scope and content of audits have also evolved with time.
Some years ago, depending on the stage of the food chain,
such audits were limited to verifying compliance with good
fishery, agriculture, farming, manufacturing, transport, or hy-
gienic practices. Later, they were developed to include audit of
HACCP. Today, with the advance of an integrated approach to
food safety management, particularly the development of ISO
22 000, audits include a variety of elements, such as:
1. Management commitment, organizational structure, cor-
porate governance and its impartiality and resources.
2. Management of people (including training).
3. Awareness and infrastructure for monitoring the regulatory
requirements of the country where products are produced
and/or marketed.
4. Product traceability, recall, and incident and crisis
management.
5. Product development.
6. Raw materials and supplier management; this should also
include any possibility of fraud or adulteration.
7. Good hygienic practice.
8. HACCP system and implementation.
9. Verification activities (consumer complaints, pathogen and
environmental monitoring, review of noncompliances, and
their root cause analysis).
The decision on the scope and frequency of audits will
depend on a number of considerations, in particular whether
the audit is a first audit or a follow-up audit. Whether a full or
a partial audit is carried out will depend on the original pur-
pose of the audit. For example, partial audits might be ap-
propriate for closing out noncompliances, for investigatory
purposes after an incident, or where a previous audit has
confirmed that a sound system is in place.
Classification of risks is an important criterion for priori-
tizing and deciding on the frequency, i.e., having more fre-
quent audits at higher-risk premises or suppliers of high-risk
material. The following information can be considered in the
classification of risks and in deciding on the frequency and
scope of the audits:
1. the potential hazards known to be associated with the
product and/ or process, including the previous records of
safety of the product;
2. the history or level of previous compliance;
3. the state of the food safety management systems and other
management systems that may be in place, for example,
ISO quality management systems and certification, total
quality management (TQM), as well as the level of in-
house expertise; and
4. other considerations such as processing methods, intended
use and population at risk, size of operation (e.g., number
of employees, volume of production, and turnover), type
of products and processes, complexity of operation,
quantity of product affected by the raw material used,
market, or trade requirements.
Similarly, the following could be considered in deciding
the scope of an audit:
1. whether it is an initial audit or a follow-up;
2. size of operation, for example, number of employees,
volume of production, and turnover;
3. type of products and processes;
4. complexity of operation;
5. level of in-house expertise;
6. amount of available resources;
7. presence of management systems, for example, ISO quality
management systems, and TQM;
8. results of previous audits; and
9. population at risk.
A change in the system (process, formulation, etc.), or the
aftermath of a natural accident or disaster, for example, fire, flood,
etc., can also justify an audit. As mentioned previously, audits
may also be triggered as results of a previous food safety incident.
Subsequent frequencies for audits and their scope can be
considered in the light of such findings.
Competence of Auditors
The validity of audits depends to a great extent on the com-
petencies of auditors and their integrity. Food safety being a
multifaceted subject, a carefully selected team of experts will
be required. The composition of this team and the expertise of
the members will be all the more important as the
290 Food Safety Assurance Systems: Audits of Food Safety Management Systems
responsibility for protecting public health is significant. In any
case, for a full scope audit, the following competences, skills,
and qualifications need to be considered:
1. the technical competence,
2. the skills in assessing and investigating (audit skills),
3. the people skills, i.e., independence of judgment, integrity
and objectivity, and finally, a good audit requires, and
4. the cooperation and openness of the audit entity in pro-
viding truthful information.
Other factors such as time and financial constraints,
availability of documents, also play a significant role.
With regard to technical knowledge, the following are
needed at the very least:
1. Understanding the basic hygienic requirements, their rele-
vance in supporting safe food production, and experience
in assessing them.
2. Knowledge of laws, regulations, standards and general
codes of hygiene, and/or criteria for the specific category of
products.
3. Knowledge of relevant industry products and processes
(including past failures in the category).
4. Knowledge of the HACCP system and its application,
including:
a. The identification and audit of potential hazards which
may occur during food production, handling, prepar-
ation, storage, and transportation, including biological,
chemical, and physical hazards.
b. The ability to assess the effectiveness of control
measures (validation) of the HACCP plan and its
verification.
5. Understanding the role of the human factor and of com-
pany culture in food safety.
Reporting Structure
Another important factor in the validity of the audits is
the organizational structure and the management reporting
system. To prevent conflicts of interest, and ensure that cor-
porate governance is functioning in all independence, it
is important that audits are carried out by teams of pro-
fessionals who are structurally independent from those who
are designing and implementing the food safety management
system.
The Procedure and Methodology
The procedure for an audit must be defined and carried out in
accordance with a set format. Auditors should ensure that they
plan the process properly, i.e., that:
1. The scope of the audit is predetermined and sufficient time
is allocated.
2. The required skills are available within the team.
3. Tools needed are made available.
4. Arrangements are communicated and agreed upon with the
site being assessed.
The procedures for audit will need to include the following
stages:
1. a planning process to prioritize establishments, operations
and their frequency, and scope of audits;
2. a desktop audit;
3. an on-site audit;
4. an evaluation process to analyze findings, determine
compliance, and decide corrective actions and follow-up
requirements; and
5. reporting and follow-up.
The Planning Process
Initial planning is important to clarify the scope of the audit
and the approach that will be taken on-site. It helps to ensure
that auditors have the necessary information and tools to
complete an effective audit. Information that will help in this
planning process includes:
1. relevant company documentation;
2. previous file records, data on premises and products; and
3. results from previous visits or audits.
The Desktop Audit
The audit itself is best carried out in two steps. The first stage,
desktop audit, consists of the initial review of documentation,
which may be carried out on- or off-site.
A desktop review also has the advantage of enabling auditors
to plan their work, for example, to judge how the CCPs have
been established, check the personnel required for detailed dis-
cussions, the specific questions to be asked, draw a list of pri-
orities to focus on, and/or areas to visit during the on-site audit.
Examples of documents to review:
1. The food safety policy.
2. The organigramme, the responsibilities of the managers
and food safety management team, and their respective
technical expertise and competences.
3. The operation, and the type of products produced.
4. The range and number of raw materials used and their
origin.
5. A site layout plan may give an idea of the flow of products
through the site, the scale of the operation and the prod-
ucts produced.
6. The HACCP-related documentation, including:
a. a process flow diagram and specifications relating to it,
b. the HACCP study (showing how potential hazards have
been identified and on which basis they are considered
as nonsignificant if this is the case),
c. an HACCP plan, including the monitoring plan and the
validation of the control measures,
d. records of CCP monitoring and corrective actions fol-
lowing the violation, and
e. verification data, for example, consumer complaints,
monitoring data for raw material, environment or end
products, and reports of incidents and root cause analyses.
7. Training programs, for example, the manual or other tools
used for training.
Food Safety Assurance Systems: Audits of Food Safety Management Systems 291
8. Incident and crisis management procedures.
9. Reports of management review of food safety and quality.
On-Site Audit
The second stage is the on-site audit.
The on-site audit will normally start with an initial or
opening meeting to confirm, with the key people being as-
sessed, the audit scope, timetable, facilities, and personnel
required and in general to ensure cooperation.
The purpose of this step of the audit is to confirm that
procedures and practices described in the food safety man-
agement system of the company or the regulatory require-
ments to ensure food safety are properly implemented in
practice.
During the on-site visit, specific attention should be given
to HACCP and prerequisite programs, including:
1. Confirmation of the accuracy of the process flow dia-
gram(s). This is facilitated by an initial walk through the
site. The auditor will subsequently need to engage in a
range of questioning and investigative activities to assess
the efficacy of the HACCP system.
2. Evaluation of the hazard analysis based on the state of the
prerequisite programs mentioned above.
3. Confirmation of the suitability of CCPs, critical limits, and
corrective actions.
4. That monitoring schedules are established and operating
correctly.
5. Confirmation that persons responsible at CCPs perform
activities correctly, understand the importance of the step
for safety, and their responsibility in case Critical Limits are
violated. This will require specific interviews with the
personnel.
6. Establishing whether effective verification procedures are
carried out.
7. Reviewing monitoring data of raw materials, products,
environment, CCPs, as well as reports of internal audits,
supplier’s audits (inclusive of supplier monitoring pro-
grams), consumer complaints, personal reports, and com-
plaints. It is particularly important to corroborate these
results with the hazard analysis (for instance, if a con-
taminant is considered as not significant in the raw
material, this is confirmed through the monitoring carried
out for verification).
During these activities, the auditors will need to keep suf-
ficiently detailed records and to collect supporting evidence to
enable conclusions to be made. Use of checklists together with
a narrative, notebooks, or where appropriate, tape recorders,
will assist this process. Depending on the judgment of
the auditors, checks might be made on items of equipment,
on-site measurements may be carried out, or product or en-
vironmental samples may be taken for subsequent laboratory
analysis.
Evaluation Process
The auditor (or the team) will need to identify and analyze
all information obtained during the audit in order to draw
up preliminary conclusions of deficiencies found, if any,
and their effect on food safety, regulatory compliance, or
other trade-related concerns. They should also advise on their
severity and the speed with which they would need to be
rectified.
Reporting and Follow-Up
The format of auditor reports varies according to company
policy and prior agreements with auditing bodies. However, it
is essential that the results of the audit be communicated to
the management of the company and to all relevant persons
within the organization (i.e., with responsibility for safety) in
a timely manner.
Where an audit report indicates critical or serious gaps,
these need to be followed up rapidly, and root cause analyses
of these gaps are also made to identify the latent cause of the
failures.
Conclusion
Audit of food safety management systems is an opportunity to
improve food safety management and close the gaps. They
should be carried out with objectivity and integrity. An un-
satisfactory audit report should not always and necessarily be a
reason for reprimanding the managers; rather over and above
closing the gaps, a root cause analysis of the situation should
be made and short- or long-term corrective action should be
made. Not infrequently, the root of the problem may be in the
management.
Reports of audits and food incidents have shown that some
of the major source of food safety problems are:
1. Raw material and supplier management.
2. Failure in the design of equipment and their maintenance.
3. Good hygienic practice violation.
4. Failure in hazard identification.
5. CCP monitoring failure.
6. Failure in corrective actions.
7. Human negligence or error.
Acknowledgment
The authors would like to acknowledge that this article is
based on personal experiences, and is also inspired from an
earlier work, i.e., the FAO/WHO Expert Consultation that she
convened on the subject of the Role of Government Agencies
in Assessing HACCP (Geneva, 2–6 June 1998). The report
of this meeting is available from the link http://www.who.
int/foodsafety/fs_management/en/haccp98.pdf under the title
Guidance on Regulatory Assessment of HACCP. The contri-
bution of all experts in providing the guidance during the
consultation is thankfully acknowledged. In spite of the date
of publication of the report, much of the guidance is still
up-to-date and relevant.
292 Food Safety Assurance Systems: Audits of Food Safety Management Systems
See also: Food Safety Assurance Systems: Documentation andRecord Keeping; Investigation of Incidents in Industry; PersonalHygiene and Employee Health. Public Health Measures: FoodInspections and Enforcement Systems; Modern Approach to FoodSafety Management: An Overview
Further Reading
Campden BRI (2009) HACCP Auditing Standard, 2nd edn. UK: Campden BRI.Dillon M and Griffith C (eds.) (2001) Auditing in the Food Industry. Cambridge,
England: Woodhead Publishing in Food Science and Technology.FAO/WHO (1998) Guidance on regulatory assessment of HACCP. Report of a Joint
FAO/WHO Consultation on the Role of Government Agencies in AssessingHACCP, 2–6 June. Geneva: World Health Organization.
FAO/WHO (2004) Global forum of food safety regulators, building effective foodsafety systems. Proceedings of the Forum. Bangkok, Thailand, 12–14 OctoberRome: FAO.
ISO (2007) Food Safety Management Systems – Requirements for Bodies ProvidingAudit and Certification of Food Safety Management Systems. ISO/TS 22003:2007. Geneva: International Standardization Organization.
Motarjemi Y (2013) Human Factor in food safety management. In: Motarjemi Y andLelieveld H (eds.) Food Safety Management: A practical Guide for the FoodIndustry. Waltham, MA: Elsevier.
Motarjemi Y and Lelieveld HLM (eds.) (2014) Food Safety Management: A PracticalGuide for the Food Industry. Waltham, MA: Elsevier.
Motarjemi Y and Mortimore S (2013) Assessment of food safety managementsystems. In: Motarjemi Y and Lelieveld H (eds.) Food Safety Management: APractical Guide For The Food Industry. Waltham, MA: Elsevier.
Relevant Websites
http://www.fao.org/docrep/009/y6396e/y6396e00.htm
Codex Alimentarius: Food Import and Export Inspection and Certification
Systems.http://ftp.fao.org/docrep/fao/010/i0096e/i0096e00.pdf
FAO: Risk-Based Food Inspection Manual.
http://www.who.int/foodsafety/publications/fs_management/guidance/en/
Guidance on Regulatory Assessment of HACCP: Report of a Joint FAO/WHO
Consultation on the Role of Government Agencies in Assessing HACCP, 1998.
http://www.iso.org/iso/home/store/catalogue_tc/
catalogue_detail.htm?csnumber=39834
ISO/TS 22003:2007 Food safety management systems – Requirements for
bodies providing audit and certification of food safety management systems.
