Today’s Inspection and Audit Reality: The New Normal

By Melanie Neumann, JD, MS
2 Comments
October 4, 2017


• Categories: Compliance, Food Manufacturing, FSMA, RC - Food Safety Management System

Food industry inspection and audit protocols are evolving at a rapid pace, and rightly so. This is not surprising given today’s regulatory, audit and ever-changing risk landscapes, which are driving further complexity and expansion of requirements to ensure the industry is, “audit ready, all the time.”

This evolution of inspections and audits has been primarily triggered by newer regulations such as FSMA and private standards, such as GFSI and its certification programme owners (CPO’s, fka Scheme Owners) like SQF, BRC, FSSC 22000, IFS, etc. Heightened customer demand and consumer visibility into food safety incidents –many thanks to mainstream and social media– and the resulting increased demand for information has also fueled this evolution, compelling industry to focus on higher levels of transparency, both internally and throughout the supply chain.

The changes above are driving the food industry to face a new reality. One where the following questions continue to rise to the surface:

• How have “yesterday’s” inspection and audit expectations changed from what companies are experiencing today?
• Based on this evolution, how will “tomorrow’s” inspection and audit expectations change?
• In short, what does the new reality or the “new normal” look like now for inspection and audit readiness?

We will take a look at what some of the first inspections are shaping up to look like under the Preventive Controls for Human Food (PCHF) Rule and the Foreign Supplier Verification Program (FSVP) Rule. Some common themes and some tips to successfully manage regulatory inspections as well as audit readiness tips are set forth below.

More Inspectors

Roll out the welcome mat because more inspectors are coming to the party. We are seeing an average of three to upwards of six regulatory inspectors performing the inspections under the PCHF rule. This may cause an initial shock wave but when you stop to consider the rationale it has a certain level of reasonableness to it. Industry has invested in its personnel for nearly two years in updated training to meet new FSMA regulations such as preventive controls qualified individual (PCQI) training, updated current GMP training and perhaps qualified auditor training, if applicable. It makes sense that FDA needs to make a similar investment in its people to ensure its inspectors are prepared to knowledgeably perform FSMA-related inspections.

FDA has implemented a robust training program for its inspectors. Regarding PCHF inspections for example, only inspectors who have successfully completed the PCQI training plus FDA’s internal training will lead other inspectors through the facility inspections as an in-field training exercise. So, the good news is at least one inspector is fully trained under FDA’s training program standards. This said, with more inspectors, there are more eyes, and with more eyes, more opportunities to see risk through different perspectives. It’s best to be on your game, with a tested playbook so you have confidence you are prepared when the team of inspectors arrive at your facility. Conduct a mock inspection against your policies, procedures and food safety plan that have been updated for the new PCHF and other applicable FSMA requirements. You will be thankful you did.

Digging Deeper

Into Records: FSMA and the seven rules that comprise it requires more controls, monitoring and verification activities by the food industry, thus naturally giving inspectors more records to access and review. Further, FDA received expanded records access authority upon the signing of FSMA. FSMA allows FDA to access records relating to articles of food for which there is a reasonable probability that the use of, or exposure to, the article of food will cause serious adverse health consequences or death to humans or animals. Before FSMA the standard FDA had to meet to access records was “credible evidence”; now its “reasonable probability”—a standard that is far lower and subjective—allowing access to more types of records than before. Another new addition is FDA now may access records beyond those relating to the specific suspect food if the agency reasonably believes that other food articles are likely to be affected in a similar manner.

Example: If you have a potential problem on production line 1, and you firmly believe the issue is contained to line 1, but that line is in even arguably close physical proximity to line 2, depending on the issue an inspector may invoke this new authority and ask for all records associated with line 2 in addition to line 1 for the same time period to be sure that the situation indeed did not spread or otherwise impact line 2. (e.g. confirm no risk for cross contamination or allergen cross-contact).

This should not mean it’s open season on all your records, but it certainly means more records are open to review and scrutiny, so having a robust record retention and management system becomes mission-critical. How sound is yours? Record-keeping and document management have long been important to GFSI / CPO’s. However, many food companies do not have a certification from one of these entities, which begs the question whether the scope of your third-party audit, or that of a supplier you are currently evaluating for approval, adequately evaluates this important area.

Into your Hazard Analysis: Inspectors are spending significant time reviewing the adequacy of the hazard analysis performed as part of the requirement of the food safety plan under the PCHF Rule and as part of the foreign supplier verification plan requirement under the FSVP rule. If facilities do not identify all the hazards of concern that require a preventive control associated with their facility and foods they produce, then the rest of the food safety plan falls apart. If you work with peanuts to produce peanut butter and identify Salmonella as a hazard requiring a preventive control but not aflatoxin or peanut allergen you have likely missed the mark.You may not have the appropriate preventive controls, monitoring, verification activities, validations and corrective actions identified in your hazard analysis and food safety plan to control for the most significant hazards your facility / the finished food is facing from a food safety risk perspective. (note the identification of hazards requiring preventive controls is highly dependent on the food, facility, processing methods of the manufacturer, upstream supplier and will vary if products are RTE or nRTE)

How are auditors tackling this issue? Many third-party audit firms have invested in providing PCQI training for its auditors so they are better prepared to evaluate the sufficiency or gaps in the hazard analysis. It is a good idea to ask your audit firm what updated skills and training have been given to its auditors to ensure you are getting the assistance you need.

Continue to page 2 below.

Lasting Longer:

It makes a certain amount of sense that inspections would take longer to conduct and complete since there are more inspectors accessing and reviewing more records than pre-FSMA.§117.190 of the PCHF Rule alone contains a laundry list of implementation records required to meet only the risk-based preventive controls requirements of subpart C (the food safety plan requirements). These records include:

• Documentation identifying the hazards requiring one or more preventive controls
• Documentation for not establishing a preventive control
• Records that document monitoring preventive controls
• Records that document corrective actions
• Records that document verification, as applicable, including:
  • Validation
  • Verification of monitoring
  • Verification of corrective actions
  • Calibration of process monitoring and verification instruments
  • Product testing
  • Environmental monitoring
  • Records review
  • Reanalysis
• Records that document the supply chain program
• Records that document training for PCQI and the qualified auditor

There are other record requirements relating to other sections of this rule, (e.g. if a facility meets Modified Requirements or Qualified Facility requirements, and subpart F relating to how records must be kept, who must sign, how long they must be retained, etc.).

Needless to say by reviewing the above list, record and document management will be key in today and tomorrow’s inspection and audit reality, in order to produce requested documents quickly, accurately and in compliance with regulations and customer expectations (lets not forget the 24 hour reporting requirement of the Reportable Food Registry (RFR) and increasing contractual requirements by customers, particularly in private label situations, where 2-4 hours is the “new normal” to report to a private label customer if a co-manufacturing facility may have a suspect or actual food safety incident at hand). For those still on manual/paper-based systems, now may be the time to consider technology as a means for managing risk.

Leveraging Technology:

Even the FDA is embracing technology folks (and no, this isn’t meant to be a slam, but rather a statement of fact). Case in point, although the first inspections are being conducted onsite for training purposes, inspections under the FSVP (Foreign Supplier Verification Rule) are intended to move to virtual inspections where relevant documents subject to inspection are requested via email by FDA and transmitted electronically from the FSVP food importer. Another example is the RFR, which requires the reporting of a “reportable food” to an online portal within 24 hours upon meeting certain criteria. If the government can embrace technology why does industry seem a bit slow to the party?

Some companies have done a stellar job of embracing this 21^st century technological evolution, or as some may describe, revolution, in which we now live and work. Others, I am sorry to report, are woefully behind in leveraging technology to manage risk. GFSI recently released its new version 7.1 with new and modified standards. For example, V7.1 adds a couple of new clauses for each scope under Food Safety Management Requirements, such as purchasing from non-approved suppliers. The ripple effect is the CPO’s are in turn updating and releasing new versions of their own respective private standards. Layer on FSMA and the seven new rules that comprise it, which includes expanded records access authority by the agency, and companies are facing an exponential increase in the number of records to manage.

Simply put, it is becoming progressively more difficult to manage all required records and documentation in a paper-based system. As a result, more companies are evaluating software systems that can help manage key supply chain, production, traceability and distribution data so they can put their finger on the pulse of information when auditors and inspectors request information. Wise choice.

Not only should an electronic document management system help with speed to identify and access documents -it should also help with data trending (to the extent applicable). For example, if you are storing PC/CCP monitoring data on oven cooking temperatures, can the electronic system track and trend the data captured so that it can alert designated users when a PC/CCP goes out of limits? The best systems can, and the best-in-class companies are finding ways to reduce the human error factor by leveraging technology to better manage their risks and transforming the data into information through dashboards and trending reports so they can see where deviations or near misses may be arising. Yes, technology involves a capex request. But the ROI is almost always cheaper than a recall and certainly is less costly than the brand reputation damage that could result.

Considering Culture:

How strong is your food safety culture? How polished are your internal team’s “soft skills?” Be prepared to jump on the collaboration train with FDA—the paradigm is shifting from FDA acting as the “police” to becoming a “partner”. Specifically, FDA is taking initiative to learn more about food safety culture- a topic growing in importance to industry and one FDA historically had not fully understood or placed inspection metrics around. Public-private partnerships have formed including conference calls with FDA and industry to learn more about how industry is assessing and implementing food safety culture, as well as discussions with CPO’s to understand how these private standards are measuring this emerging topic. The net takeaway is that FDA is now looking at and assessing your food safety culture.

How is it being used? Food safety culture is factored into the scope of preventive controls inspections, according to Joann Givens, deputy regional food and drug director with the FDA, during a speech given at the Process Expo conference in September 2017. Further, Givens says regulators are receiving soft skills training to better interact with industry to create a spirit of collaboration and partnership. This level of training investment at the agency level clearly conveys the importance of providing the same type of training to industry– to ensure that we aren’t the ones with the poor “bedside” manner and poor interpersonal skills when FDA shows up on our doorsteps, and to ensure we are continuously striving to mature our food safety cultures.

Final Thoughts:

The “new reality” is that industry’s preparation for inspections and audits needs to evolve based on the expectations of today’s – and tomorrow’s – inspectors, auditors and customers alike. FDA is learning along-side industry during this first year or so of PCHF and FSVP inspections. Some may be skeptical of the FDA mantra “educate before and while we regulate”. However, it does appear through some of the first inspections that this is truly a mantra that is being embraced by the agency, and as such, industry is encouraged to work collaboratively and openly with the agency in this spirit of learning and collective mission of protecting public health and safety. It is a unique time of evolution and transformation in the food industry. Every player in the supply chain must find ways to transform to a new reality wherever they may be in the supply chain, and define a new normal to keep up with this evolution, or risk the cruel reality of being left behind as a memory of yesterday.