Joan Rosen on Audits and Traceability

In November 2022, traceability was brought to the forefront of the food industry’s attention when the U.S. Food and Drug Administration (FDA) posted its final rule on the tracking and tracing of foods. This rule was created to “facilitate faster identification and rapid removal of potentially contaminated food from the market.”

Traceability has always been a critical part of documentation in audits. In a food safety audit, objective evidence is gathered by the auditor to determine if a food safety system is appropriate and effective. The auditor assists the company in determining if hazards are properly identified, then controlled or eliminated.

In this interview, fresh produce expert Joan Rosen, founder of consulting firm JC Rosen Resources and former global director for food safety and quality for Chiquita Brands International/Fresh Express, shares practical insights on the workings of the independent audit and how traceability can enhance its outcome.

What are the biggest challenges food processors face during a food safety audit?

I think one of the main ones is to have clarity on the standards that the company is being evaluated against. Because that's what an audit is, it's an evaluation of compliance to a standard. Once the company is clear on that, it's really important for them to easily access any documents that demonstrate compliance, when the auditor is present. [This] provides confidence that the processor has really implemented and is using their food safety programs all the time and they're not just preparing for an audit.

Another challenge is making sure that all the relevant parties are fully aware of their roles. The various departments must ensure that policies and procedures are in place [and] that they understand the importance of the food safety program. Sometimes a company may say, "Oh, it's a food safety audit. It's the food safety department's responsibility." Whereas it's really a company responsibility and everyone, different people in different departments, have responsibilities and accountabilities for food safety.

[A third] challenge is auditor consistency. Even if the auditors are from the same certification body, sometimes different auditors can have different perspectives. That can really become a source of frustration. Maybe one year an auditor says, "Yes, you're in full compliance," and then nothing has changed prior to the next audit. The next year the [new] auditor says, "Well, no, you're not in compliance." That [lack of] consistency can be challenging.

The last big challenge is around interpretation of the audit standards. An auditor may believe that what they're reviewing does not meet the standard or violates it. But, as the auditee, you may not agree with that. Having disagreement over the findings can be a challenge at times.

Are most audit deficiencies related to documentation?

Audit deficiencies in that area are in two main clusters. One is where the records don't make sense. Things are missing or there's some data showing an out of compliance measurement. [As an example], your specified range for your process is between 10 and 20 units but you have a 25. You're out of compliance, but you didn't have any documented corrective action for that occurrence.

The other area related to documentation results in a more aggressive response from an auditor. It’s a situation where they observe what is going on in a processing plant and find that’s not what's written down. There is no alignment between an SOP and the activities on the plant floor.

In your experience, what are the most common deficiencies?

It can be basic GMPs, good manufacturing practices. That's surprising because they are foundational food safety programs. Companies can get caught up in the audit standards and lose sight of the basics. [They can have] tunnel vision around what is expected for the audit as opposed to the overall food safety program.

Other deficiencies may be around sanitation, which are more visible if an auditor is present during the sanitation shift. [Auditors] can look at documentation for a sanitation program, but it's not the same as being there for the shifts.

The lack of alignment between a company's SOPs and their records can be challenging, as can missing follow-ups of deficiencies. Companies need to do internal audits on some periodic basis. If they identify some deficiencies themselves, the expectation is that there would be documented follow-up to those deficiencies.

And then probably training. Specifically, while training may have been completed, there could be a lack of documentation.

Preventive maintenance is another one. [An auditor might see] temporary repairs, the use of duct tape, rust, or equipment not in the best condition.

Do you believe that audit deficiencies are inevitable?

If you look at the criteria that a lot of audit standards use for minor, major, and critical deficiencies, probably some minor ones are going to be inevitable because nothing's perfect. Identification of those deficiencies is really an opportunity. I do think that most major and critical deficiencies are avoidable.

As an auditor, do you always find a deficiency, no matter how small, to prove your usefulness?

I would say that food operations are complex. There's no way that you won't find something. I always remind my clients that an audit is not a food safety program. It's an objective evaluation of compliance to a set of standards. The processor's food safety program should be protecting consumers, the company, and the brand.

What are audit issues related specifically to fresh produce?

Fresh produce is a complex part of the food industry. [There may be] challenges in having a robust supplier management program and following the requirements of that program. Fresh produce is unique because there's no kill step. That makes the food safety programs even more important. A lot of companies rely solely on third-party audits of their suppliers. A more robust program is integrating that approach with periodic on-site evaluations.

Another challenge for [fresh produce] companies is that many are also buying non-produce items. You see a lot more salad kits with produce components and non-produce components. Some produce companies may not have a sufficient understanding of the potential food safety hazards from those non-produce items.

Another area is around understanding the fresh produce wash system and the use of antimicrobials used to treat wash water. Companies need to have validation and verification of those systems.

Finally, [there are challenges] around Listeria management and environmental monitoring programs. Again, fresh produce has no kill step and it's critical to have a robust Listeria management program that includes environmental monitoring and GMPs.

Is there a question that you were hoping you would be asked?

I've thought about three questions that would be interesting. “How can they [audits] be improved?” I think having better trained and more consistent auditors, more alignment of the audit process, having audit questions that are more meaningful and really designed to delve into a food safety program [would be improvements].

“What is the purpose of the audit? And, related to that, “Are the audits really doing the job that they claim to do?” They should be verifying food safety in the industry. They're certainly essential for business relationships but do they make any difference? Are you getting a benefit? We've had a lot more audits over the years, but we're still having issues with food safety. Is there some kind of an imbalance there? With more auditing, why do we not necessarily see a benefit with better food safety outcomes?

What do you think are the most useful traceability technologies?

Fresh produce has a very complex supply chain. What's really important for traceability is being able to capture the relevant, accurate information that you need in a timely manner. There's nothing wrong with paper records as long as you can accomplish what you need to do in a timely manner. Most companies either use in-house computer programs that they've modified, or they use traceability software. If you need to capture or identify a larger scope of data, I think software is really the only solution to be able to get all that data and summarize it quickly. FSMA's final rule for traceability, Section 204, doesn't specifically mandate having a certain technology. You simply need to have the outcome that's required in the rule.

Regardless of whatever technology is used, it's really important that [your] people know how to use it. They [need to be able to] capture information 24/7 because issues can happen at all times. You want to make sure that your software is well supported [by the provider]. Sometimes companies want to use software that others in the same space are using to integrate data in their supply chain.

How can we tie traceability technologies to a better audit outcome?

One area is a mock recall, or more specifically, a mock trace. Traceability technologies don't make food safer. Their main purpose is to identify the scope of an issue and minimize exposure as quickly as possible. Many companies that have been exploring traceability technologies have identified that it's not just about food safety. It's really about your business practices and supply chain, understanding every step, where everything goes, and where it comes from. [Traceability technologies] offer a way to identify inefficiencies in your supply chain and business operations.

Traceability Rule Aims to Boost Food Safety

Companies in the food supply chain who make products at higher risk for contamination will need to meet new traceability requirements by January 2026. In announcing the final rule on Requirements for Additional Traceability Records for Certain Foods in November 2022, the U.S. Food and Drug Administration (FDA) said the rule aims to reduce foodborne illnesses and deaths by improving the speed at which potentially contaminated food is identified and removed from commerce.

The Food Traceability Rule will enhance recordkeeping standards for producers, manufacturers, processors, packers, foodservice operators, retailers, and other supply chain participants with specific foods identified on the Food Traceability List. It also identifies critical tracking events in the supply chain, such as cooling, initial packing, shipping, receiving, and transforming the goods that would require records to be captured containing key data elements (KDEs).

“The [new traceability] rule specifies what information needs to be collected,” explains Bryan Hitchcock, IFT’s chief science and technology officer and executive director, Global Food Traceability Center (GFTC) “There are key data elements that must be documented at various points as the food moves from harvest or catch to retail or restaurant.”

Hitchcock adds that capturing the KDEs at the identified supply chain links outlined in the final rule will require high-tech digital solutions and more effective communications with FDA and between companies.

“Anyone who is subject to the rule requirements must be able to provide a sortable electronic spreadsheet to the FDA within 24 hours of a request,” Hitchcock says. “The rule also specifies what information they need to communicate to the next person downstream in the supply chain.”

Hitchcock notes that IFT’s GFTC is working on providing interpretation and educating the industry on the key areas of the rule such as steps to create the required traceability plan and KDE recordkeeping.

“The rule has is pretty complex and there's a lot of change relative to how industry handles traceability information today,” he says. “We're planning on publishing a series of resources to help people lay the foundation for industry and others to understand how this rule will impact them.”

Find out more about the FDA Food Traceability Rule online.