Auditing Food Safety

Domestic and foreign facilities that manufacture, process, pack, or hold food for human or animal consumption in the United States are required by the Bioterrorism Act and the Food Safety Modernization Act (FSMA) to register with the U.S. Food and Drug Administration (FDA) and have a food safety plan in place that includes identification of potential hazards and preventive controls to minimize or prevent hazards. Food safety audits, also referred to as food safety inspections, are an important check on the effectiveness of these plans. Audits range from a company’s own checks on its ability to produce safe food to regulatory checks to verify that the processes and products meet federal or other food standards.

Companies that conduct audits may be accredited to certify that a food company or supplier meets established food safety standards; these companies are referred to as certification bodies. The accrediting organizations are authoritative government or private organizations that oversee certification bodies. Accrediting organizations must meet ISO/IEC 17011 requirements for competence, consistent operation, and impartiality; be a member of the International Accreditation Forum; and sign the forum’s ISO/IEC 17021 multilateral recognition arrangement. There are accreditation bodies in 37 countries. The accreditation body in the United States is the ANSI-ASQ National Accreditation Board, an internationally recognized multidisciplinary accrediting body with a strong presence in the global market, operating in many areas of accreditation.

Another organization related to food safety standards is the Global Food Safety Initiative (GFSI). It is not an accreditation body or certification body but establishes food safety benchmarking requirements and recognizes those food safety certification programs that meet those requirements. The GFSI recognizes a certification program when the program has been verified as meeting the internationally recognized minimum food safety requirements laid out in the GFSI Benchmarking Requirements. It addresses not only the content of the auditing standard related to food safety but also the management of the benchmarked organization. GFSI-recognized certification programs have become widely used in global supply chains as an indication that a company meets strong food safety standards. Among the GFSI-recognized certification programs are the Food Safety System Certification (FSSC) 22000, which is based on the ISO 22000 food safety management system and the ISO 22003 sector-specific prerequisite requirements; the British Retail Consortium’s BRC Global Standard for Food Safety; the Safe Quality Food Institute’s SQF Code; and others listed on the GFSI website. A food company can decide which certification program or standard it wants to compare against, then have a third-party audit by a certification body to determine whether the company meets the standard.

FDA Activities
The FSMA makes it clear that the food industry has the primary responsibility for food safety. The FDA’s role is to establish risk-based food safety standards and oversee industry to help ensure that food companies and their suppliers are meeting FDA food safety standards. Seven rules implement the FSMA: Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food; Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Food for Animals; Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption; Foreign Supplier Verification Programs for Importers of Food for Humans and Animals; Accreditation of Third-Party Certification Bodies to Conduct Food Safety Audits and to Issue Certifications; Mitigation Strategies to Protect Food Against Intentional Adulteration; and Sanitary Transportation of Human and Animal Food.

The preventive controls rules for human and animal food and the Foreign Supplier Verification Program (FSVP) rule do not require auditing, but audits are one type of activity that importers can use to verify that their foreign suppliers are producing food in a manner that provides the same level of public health protection as the preventive controls rules. The preventive controls rules require domestic and foreign facilities that manufacture, process, pack, or hold human food and animal food to develop and implement a written food safety plan. The food safety plan must be reanalyzed at least once every three years, and each production facility must have its own written plan. The plan must be written or overseen by a preventive controls qualified individual, a person who has completed training in the development and application of risk-based preventive controls or is otherwise qualified through experience to develop a food safety system. The rules do not require any specific certifications, such as certification by the Food Safety Preventive Controls Alliance.

Audits for preventive controls and FSVP do not have to be conducted by auditors accredited under the certification program, but they must be conducted by auditors who have had appropriate food safety experience, training, and/or education and do not have financial conflicts of interest. Organizations can apply for FDA recognition as a third-party accreditation body via the program’s website. Recognized accreditation bodies are listed on the FDA’s Public Registry of Recognized Accreditation Bodies website.

The accredited third-party certification rule established a voluntary program for the accreditation of certification bodies to conduct food safety audits and issue certifications for foreign facilities and the foods they produce for humans and animals. Importers can use these certifications from foreign suppliers to help establish their eligibility to participate in the FDA’s Voluntary Qualified Importer Program (VQIP), which provides expedited review and import of food into the United States. To be recognized by the FDA, an accreditation body must meet requirements for legal authority, competency, capacity, conflict-of-interest safeguards, quality assurance, and record procedures. Accreditation bodies recognized by the FDA can be a foreign government agency or a private third party. They must evaluate and monitor the certification bodies, conduct self-assessments, and submit reports and other notifications to the FDA. An accredited certification body must conduct a regulatory audit to determine compliance with applicable FDA food safety requirements before issuing a food or facility certification. Any deficiencies identified during the audit must be corrected, and the auditor must verify that they are unlikely to reoccur. Besides the VQIP, the FDA may also require certification when there are safety risks associated with the food product or questions about the capability of the regulatory system of the exporting country to comply with FDA food safety standards.

The FDA has a Systems Recognition program that uses the International Comparability Assessment Tool (ICAT) to help foreign governments determine whether their food safety system is comparable to the U.S. food safety system. It covers the following areas: the country’s legal and regulatory foundation, training programs, inspection programs, program assessment and internal audit programs, food-related illness outbreaks response, compliance and enforcement programs, industry and community relations, program resources, international communication and harmonization, and laboratory support. The ICAT describes the basic quality assurance reviews needed to evaluate the effectiveness of the food safety and inspection program, recognize trends in inspection coverage, and identify best practices used to ensure a safe food supply. The ICAT applies only to human food. A desk audit is followed by an in-country assessment.

The FDA is planning to propose a laboratory accreditation program for analyses of food as required by the FSMA. Domestic and foreign laboratories would be accredited under this program and listed in a public registry of FDA-recognized laboratory accreditation bodies and accredited laboratories, separate from the accredited third-party certification registry described earlier. The program would provide for the recognition of laboratory accreditation bodies, including independent private laboratories and government laboratories with demonstrated capability to conduct sampling and analytical testing of food. Accreditation bodies recognized by the FDA would accredit foreign laboratories as long as the foreign laboratories meet the accreditation standards applicable to domestic laboratories.

USDA Activities
The U.S. Department of Agriculture (USDA) also conducts audits. The USDA’s Food Safety and Inspection Service (FSIS) conducts comprehensive audits of foreign countries’ food safety inspection systems related to meat, poultry, and eggs to ensure that they are equivalent to those of the United States. The FSIS provides a website listing foreign establishment audit reports by country and calendar year. The FSIS also accredits nonfederal analytical chemistry laboratories and conducts random audits. Accredited laboratories can be used in lieu of an FSIS laboratory for analyzing official regulatory samples.

The USDA’s Agricultural Marketing Service (AMS) provides audit and accreditation programs based on ISO Standards and Hazard Analysis and Critical Control Point (HACCP) principles and guidelines. The programs provide producers and suppliers of agricultural products the opportunity to assure customers of their ability to provide consistent quality products or services. The USDA-AMS verifies their documented programs through independent, third-party audits.

The AMS also conducts audits of companies with regard to livestock, poultry, and seeds; fruits, vegetables, and specialty crops; and dairy products. Audits cover food safety controls, quality management systems, personnel policies, good manufacturing practices, sanitation, pest control, packaging/labeling, inventory practices, recall/return, and food defense programs. The AMS also has a Process Verified Program that offers applicants a way to market their products to customers, using clearly defined, implemented, and transparent process points. An applicant’s program may include one or more agricultural processes or portions of processes that are supported by a documented management system and independently verified by a qualified AMS auditor. The auditor conducts a desk audit to ensure that all program requirements are accounted for and documented in the company’s quality manual, followed by a comprehensive onsite audit of all facilities and phases of the operation that have an impact on the process points.

Auditing and Consulting Services
The following companies offer third-party auditing, certification, and/or consulting services to help food companies meet the requirements of the FSMA.

• AIB International Certification Services
• AMETEK
• ASI Food Safety
• CERT ID
• Dicentra
• EAS Consulting Group
• EHA Consulting Group
• Eurofins Scientific
• Food Safety Net Services Certification and Audit
• Kellerman Consulting
• Mérieux NutriSciences
• NSF Food Safety Certification
• RSM US
• Safe Food Certifications
• WQS

Neil H. Mermelstein,
IFT Fellow, Editor Emeritus of Food Technology
[email protected]