Accreditation, certification, certificates…the structure that supports the third-party audit system can be very confusing! Further, an audit company offers a menu of audits: An audit to their own private standard, audits to several GFSI benchmarked schemes, and perhaps in the future, an “FDA accredited” audit. How do you know which one you need? How do you know which best prepares you for FSMA?

Jennifer McEntire spoke during the session, “Staying Ahead of New USDA and FDA Mandates for Controlling Pathogens in Food Processing” at the Food Safety Consortium conference.  LEARN MOREUntil the compliance dates for the Preventive Controls rules pass, food manufacturers really only need to be compliant with good manufacturing practices (GMPs), from a regulatory standpoint. There are some specific audits that evaluate adherence to GMPs, but many companies wanted to take their food safety programs to the next level by demonstrating that they were implementing effective food safety management systems. Certification to a GFSI-benchmarked audit scheme (BRC, SQF, FSSC22000, IFS, etc.) was a primary means to show a commitment to food safety and the demonstration of exemplary programs. With the finalization of the Preventive Controls Rules, FDA is catching up. So how do the FDA requirements compare with the main elements of the GFSI Guidance Document?

Let’s evaluate the extent to which the scope of GFSI aligns with FSMA. In September, the Preventive Controls for Human Food rule was finalized, and the areas addressed within that rule constitute the bulk (although not all) of the topics covered by GFSI (GFSI covers additional areas for which FDA has not yet finalized rules, such as food defense and traceability). The question on everyone’s mind is, “If I’m certified to a GFSI-benchmarked audit scheme, am I compliant with the rule?” The answer is, “You’re probably in way better shape than someone who is not certified.” The reason is, regardless of which GFSI benchmarked audit scheme you choose, your facility will need to demonstrate, through fairly exhaustive documentation, the nature and validity of the programs that are in place, and the proof that those programs are followed day in and day out. FDA is looking for the same thing.

The Preventive Controls rules go beyond strict HACCP in that they require facilities to consider what has historically been termed the HACCP system. This includes programs that may not be critical control points (CCP) per se, but are critical to the safety of the food product. FDA identifies elements of sanitation and allergen control, as well as a supplier program, in this category. If you’re familiar with FSSC 22000, you might call these “operational prerequisite programs”.  FDA will want to see how each and every hazard is evaluated to determine if it needs a preventive control, whether that is a traditional CCP or another control. For the most part, this is aligned with the GFSI benchmarked schemes, although some of the language may differ.

When it comes to the implementation of a supplier program, facilities should be aware that FDA’s requirements of such a program are much more explicit than most of the GFSI-benchmarked schemes. Even if the result is the same at the end of the day, FDA inspectors may be looking for companies to follow a fairly structured approach compared to a GFSI auditor.

To further complicate matters, FDA will be finalizing a program for the accreditation of third-party auditors. If an effective private third-party audit system exists, why is FDA adding another layer with its own form of audits (separate from inspections)? The answer lies with Congress, not FDA, as it identified two specific circumstances in which a special regulatory audit would be necessary. One situation is when a facility (or their customer) wishes to participate in the forthcoming Voluntary Qualified Importer Program. The second is if FDA has determined that the food poses food safety risks such that a facility wishing to export that food needs a certification issued by an auditor under this program. In neither case will domestic facilities be audited under this program; this program only applies to foreign facilities and only in very limited instances.

Since the rule and accompanying guidance documents related to accreditation of third-party auditors hasn’t been issued by FDA, it is premature to comment on how these audits will compare to those in use by private industry today.

So with the implementation of new rules from FDA, is there still a market for audits? Absolutely. From a very practical standpoint, FDA won’t be inspecting most facilities on an annual basis, and many private audits are conducted on an annual schedule. Plus, industry typically pushes itself further than regulations, which lag behind. Regulations can be viewed as the floor for expectations, but not the ceiling. Moving forward, we expect audit standards and private audits to become even more stringent and aggressive in terms of promoting the very best food safety practices. But beware, as history has shown us, a certificate is not a guarantee or indication of the ongoing quality of a plant’s food safety system. This is why FDA will not blindly accept that a facility has a favorable audit; regardless of the audit certifications you hold, FDA will still inspect you. That said, depending on the audit, it can serve as a credible certification of a food safety system in a plant and demonstrate to your customers your level of food safety commitment.  And poor performance during an audit can find its way to FDA too, since in some instances the agency will have access to the conclusions of the audit and corrective actions taken in response to significant deficiencies identified during the audit. FDA initially proposed that serious issues uncovered during consultative audits conducted as part of the third-party accreditation of auditor program would be shared with FDA, and when audits are used as part of supplier programs, FDA will see how serious deficiencies in audits have been addressed. Be clear on why you are pursuing a particular audit, and take the program seriously. Audits should reflect your food safety culture, not serve as your motivation.