ISO 22000: Getting Prepared for an Audit

What is an External Audit?

Can you imagine your collage days, when you were waiting for an exam? Now imagine you’re a student who is aware of a major exam scheduled for the end of the month. Instead of studying throughout the week leading up to the exam, you decide to cram the studying into the final 24 hours prior to the exam. You might be thinking to yourself, “That leaves far too much to chance; what if there isn't enough time to cover a certain concept in-depth, or to ensure a full understanding of the subject on the whole?” Those are the same concerns that come along with preparing for a third-party food safety audit. If a food safety manager leaves preparation for the last few weeks leading up to a food safety audit, it will most certainly affect for his or her food safety audit score. Because business success hinges on an outstanding audit score, it’s easy to understand the dangerous consequences when lack of audit-readiness can bring. Third-party auditors use relevant standards such as ISO 22000, BRC, FSSC 22000, HACCP or any other standard to ensure facilities are compliant with the criteria of the concerning standard which means your facility needs to meet or exceed audit standards every time.

With the changes from recent legislation and the numerous, occasionally competing, food safety standards in place, it can be daunting to know how to prepare for a food safety audit. ISO, FDA, USDA, GMPs, GFS I, HACCP, SQF, BRC, FSSC, IFS—the alphabet soup of shifting management programs and agency oversight—are enough to alarm even experienced quality assurance professionals. Though different standards can measure various aspects of the manufacturing and distribution process in different ways, each is designed to improve food safety by reporting and measuring controls and activities such as cleaning, sanitizing and worker hygiene. Depending on the facility and the standard under which it is being audited, specific requirements and their implementation will vary. However, manufacturers who have strong programs in place should think of audits as opportunities to identify how to further improve operations rather than something to be feared.

A Foundation in Good Manufacturing Practices

One overarching theme found in all of the Global Food Safety Initiative (GFS I)-recognized programs are suitability and cleanability to help assure the floors, walls, ceilings, equipment and personnel do not pose a potential risk to the food being produced. These food safety basics are not new; in many ways, they parallel to the requirements published in the Code of Federal Regulations and apply to food manufacturing facilities regardless of whether they fall under regulation by the U.S. Department of Agriculture (USDA) or the U.S. Food and Drug Administration (FDA). Industry-created standards, such as the GFS I-recognized programs like Safe Quality Food (SQF), British Retail Consortium (BRC), Food Safety System Certification (FSSC) and International Food Standard (IFS), lay out the rules that a manufacturer must follow in order to control the safety and quality of their product. The initial push for implementation and certification against these programs came primarily from the food retail community for their private label products, but in recent years, the push has extended to manufacturers of branded products as well as other players in the food production chain, such as ingredient manufacturers and manufacturers of food packaging materials, which come into direct contact with foods. A manufacturer must first implement the food safety management program and then have it audited and certified by a qualified, external, third party audit firm called a certification body. If the audit is successful, the facility is certified for 1 year.

Certification Audit Preparations

When you have implemented your program and have completed your internal verification of your program. As you prepare for your certification audit, here are some basic tips that can help you:

Review the standards – Think of audits like a test in which all of the answers are provided. The standards by which your facility will be judged are clearly laid out, but it never hurts to review them again to see if any have been updated or changed since the last audit.

Conduct an internal pre-audit – Using a checklist with the latest standards that apply to your operation, schedule a daylong walk through of your facility to observe your processes from start to finish. Have a marked-up copy available for review. Try to look at operations from an outside perspective. Whatever the result of the pre-audit, fix any problems that are noted.

Document – Make sure that logbooks, product labels, date stamps, invoices, customer lists and other documents and records prove that you can recall products quickly. Be sure to download any logs you might need; some can be modified to address recordkeeping requirements for the audit, but make sure they provide the information needed to show the auditor that you are consistently meeting the standard's requirements and your own internal requirements.

The Day of Audit – Facility Audit Agenda

Audit agendas are varying according to the standard, but the normal pattern of events are as follows:

Opening Meeting – Confirm the appointment details; introduce the auditor(s) and auditee contacts, confirm scope and the day’s agenda.

Tour of Operations – Areas toured depend of the type of facility, but might include raw material storage areas, production, finished goods storage, personnel facilities, maintenance, chemical storage, packaging storage and external areas e.g. where dumpsters are located. The auditor might interview some operators.

Food Safety File (paperwork section) – New auditees should have at least three months’ worth of paperwork available (unless a short season crop packing facility i.e. in operation less than three months of the year). Please note that the auditor cannot accept documentary evidence after the audit has ended e.g. if on the audit, a pest control document is missing and the auditee tries to fax it the next day, it cannot be used to alter the score.

HACCP Section (if relevant) – The auditor might look at the HACCP file in the opening meeting in order to orientate him or herself about the site program and CCPs. Auditor will interview CCP operators.

Food Security Section – The auditor will have made notes about physical security aspects when carrying out the tour of the operation. These questions are scored.

Miscellaneous Questions and New Questions – Might be covered at any point in the audit, as the topics arise.

Auditor "Quiet" Time – Time required for the auditor to collate notes before delivering the closing meeting.

Closing Meeting – Discuss findings with the auditee team. Auditors are not able to provide either a final score or pass/fail commentary at the end of the audit due to the high number of questions that are asked in the template and the scoring system that is applied. Auditors however do expedite audit reports very quickly and auditees should contact audit firm if reports have not been received within two weeks after the audit has occurred.

It is imperative that the facility is running product i.e. processing, packing, cooling (whatever functions are usually occurring as on a “normal” day) and that a normal compliment of personnel are on site when the audit occurs in order for the auditor to complete a valid assessment. If the facility is not running and/or there are no production employees or product on site, then the audit will have to be terminated and cancellation charges will be applied or the audit can continue as a pre-assessment audit. Please ensure that auditee personnel are available to follow the facility tour and are well versed in the areas that are being inspected.

Documentation Requirements

New Facility Auditees/First Time Facility Auditees

In operation for more than three consecutive months – Auditee should have at least three months of documentation available for review. If the facility has less than three months of most of their documentation available for review a pre-assessment audit is strongly advised. If the auditee has less than three months of most of their documentation available for review and decides to have a regular audit, they should be aware that they cannot receive full conformance for paperwork questions relating to monitoring and that the down score will be based on the amount of paperwork available.

Short season operation, in operation for less than three consecutive months – Auditee should have at least three months of documentation available for review (this may include last season’s documentation). Where an operation does not have three months of records available (e.g. one month of operation per year) auditee should have at least the previous season’s records available for review. If the auditee has less than three months of most of their documentation available for review and decides to have a regular audit, they should be aware that they may not receive full conformance for paperwork questions relating to monitoring and that the down score will be based on amount of paperwork available.

Management Reviews – There must be two consecutive management review data available for the auditing, basically you can have a management review after you start preparing your facility for a certification against a given food safety standard (i.e. ISO 22000) and when you complete the process of implementing your system and after the internal audit is completed.

Existing Facility Auditees

In operation for more than three consecutive months – Auditee should have at least three months of documentation and documentation at least since the last audit.

Short season operation, in operation for less than three consecutive months – Auditee should have at least three months of documentation and documentation at least since the last audit (which includes the last season). Where an operation does not have three months of records available (e.g. 1 month of operation per year) auditee should have at least the previous season’s records available for review.

Visual versus Verbal Confirmation

Visual confirmation is the default method of auditing, whether on the plant tour or the paperwork section. Scores and comments are assumed to have been visually confirmed unless otherwise stated. Verbal confirmations should be the exception to the rule and if auditing properly, these should be rarely used. If a verbal confirmation is accepted, then the auditor should write this in the comments on the question.