This document discusses the benefits of third party food safety audits and outlines some issues that have arisen due to failures in the auditing process. It summarizes two major food safety crises in the US linked to failures of third party audits, highlighting the need for more rigorous auditing standards and processes. The document advocates for harmonized global food safety standards, process-based auditing, ensuring auditor competency, and the role of certification bodies in continuously improving food safety.

1. Why third party audits are good for food safety
Alex Briggs, Editor www.businessassurance.com
Introduction
The global food supply chain has become increasingly complex over the last 50 years. Raw
materials are grown on one continent, processed on another, packaged on yet another and
then shipped and sold all over the world. This has led to new logistical challenges and a
dramatic increase in risks to both consumers and global brands as they battle for share of
supermarket shelves. An incident in any part of the supply chain can have legal, brand and
even criminal repercussions for the food brand names that are a part of our daily lives. To
help mitigate such risks and to have better product traceability and control over their supply
chain, many manufacturers and retailers have implemented a range of food safety
management systems standards and schemes, many of which have been independently
certified. For most of the world, this has driven continual improvement, helped mitigate risks,
led to increased efficiencies across the supply chain and helped suppliers reduce costs.
However, in the US, two food safety crises over the past three years have led certain
interested parties to question the role and even complicity of both second and third party
certification industry in managing risks in the food supply chain.
To help put into context where we are today, we should revisit a particular incident that
occurred on Jan. 13th, 2009. On that date, the Peanut Corporation of America issued a recall
for products it had made over the past six months, after five people had died and more than
400 had fallen ill with salmonella poisoning as a result of contamination. Two weeks later, the
recall was extended to more than 400 consumer products made since Jan. 1, 2007, while the
toll from the contamination had reached eight dead and more than 500 sickened in 43 states,
half of them children. The company's factory in Blakely, Ga., which was the source of the
contamination, supplied some of the largest food makers in the nation. The outbreak
illustrated the complexities of the industrial food chain, and left consumers scrambling to
figure out if the food in their cabinets posed a danger. The Peanut Factory salmonella crisis
led to a fundamental review of the approach to food safety in the US. The crisis was directly
linked to the US Government’s Food and Drug Agency (FDA) and their impossible task of
inspecting the plethora of food organisations in the US. Media articles, including an in-depth
one in the New York Times, highlighted the failures in the auditing process, the lack of
relevant experience of the auditor and auditing company as well as the lack of a robust
standard against which the audit was carried out. The article was accompanied by a range of
supporting material that included insight from key food safety stakeholders, each stating what
they thought was wrong with the inspection approach to auditing in the US food supply chain
and outlining possible solutions.
Out of this crisis came a new FDA plan, one which recognized the need for best practice and
more knowledgeable, better skilled auditors. Addressing best practice, the FDA studied the

2. approach to food safety taken by Australia, Holland and other nations who were considered to
be more successful in mitigating food supply chain risks. To address the limited resource
issue, the FDA installed a system that gave preferential treatment to organisations who could
demonstrate a voluntary commitment to third-party inspection through independent audits and
reports.
Note the word inspection here, as that was the part of the approach that remained
unchanged after the FDA review post Peanut Factory crisis. This fact would come back to
haunt the food sector less than three years later.
Fast forward almost three years and, once again, third-party auditing was at the centre of a
food safety crisis in the US. Between September and December of 2011, a canteloupe-borne
Listeria outbreak killed 30 people, the deadliest food borne illness outbreak in the US in over
25 years. As well as the deaths, 146 people became ill and a pregnant woman miscarried.
A US federal investigation into the cantaloupe listeria outbreak found that the farm that
produced them had ignored government safety guidelines. FDA officials who visited the
Jensen Farms' facility stated that the outbreak could have been prevented if Jensen Farms
had maintained its facilities in accordance with existing FDA guidance. They found 13
samples of Listeria monocytogenes obtained from processing equipment and cantaloupes
and cited several deficiencies in Jensen Farms' facility, such as dirty water pooling around the
food processing equipment, inappropriate food processing equipment which was difficult to
clean and no antimicrobial solution in the water used to wash the cantaloupes.
The congressional investigation report notes that Bio Food Safety, a subcontractor for Primus
Labs, a third party food safety auditor, which was hired by Jensen Farms, gave the facility a
96% rating, "despite finding several major and minor deficiencies". Bio Food said the audits
only deducted from the score if a method or technique was inconsistent with FDA regulations,
but not if FDA guidance was not being followed – hence the rationale behind the high ratings.
What is apparent is that the Jensen Farms audit was a ‘checklist approach’ and not a process
based audit which looks at the whole series of interacting processes that form a management
system. In parallel, and from widely available reports, it appears that the auditor from the
sub-contracted firm to Primus had little or no food sector experience which only added to the
problem, raising even more questions about the 96% rating awarded to the site.
If you are starting to think “wait a minute, haven’t we been here before?”, you are not alone.
Both of these seismic events have highlighted weaknesses in the US approach to food safety.
These incidents demonstrate how much is still left to do in order to mitigate food supply chain
risks, how important experienced, competent, qualified auditors are in the assessment and
certification process and the importance of moving away from snapshot-in-time style audits

3. and towards a process-based management systems approach to audits that look at the
systems and processes that organisations have in place.
What steps should the FDA, as the government organisation who can single-handedly
influence the behaviour of organisations across the food supply, now take? A start could be
the acceptance and even insistence on industry developed, globally accepted standards and
schemes. Following the GFSI lead, FSSC 22000 and ISO 22000 could be a very good
starting point. The FDA has hinted at an accreditor type role (in other words, they would be
the gatekeeper for auditing bodies, ensuring that only competent auditors with relevant
sector-specific experience are performing audits). Further, this would hold certification bodies
and registrars to a higher level of scrutiny and transparency than is currently the case. That,
in turn, would help build confidence in the assessment process and in the resulting certificate.
While a certificate on the wall will always be a part of the process, it need not be the end all
be all. Ensuring the effectiveness of the systems and processes that govern an organisation
and making sure that risks are properly assessed and managed, that is the true value of
independent assessment.
Transformation - harmonisation of standards
Globally, food has never been safer. Driven by food scares and a heightened focus on risk
mitigation, there has been a move by Governments, manufacturers and retailers to join forces
and put independent third-party assessment and certification at the heart of food safety.
Today’s global food supply chain is exponentially more complex than it was 50 years ago and
yet, the food products that are grown, processed, packaged and sold in all corners of the
globe are significantly safer than they have ever been. That these apparently conflicting facts
can simultaneously exist is largely an output of the collaboration and transparency that is
being led by the most influential food manufacturers and retailers. Two particular areas have
worked together to bring this about; the first of these is the harmonisation of standards.
Harmonised, robust food safety management system standards and schemes have brought
increased transparency and best practise sharing across sectors and geographies.
The Global Food Safety Initiative (GFSI) was formed in 2000 by leading global retailers and
manufacters specifically to address food safety issues and the lack of harmonisation in food
safety standards and schemes. Together with the International Organisation for
Standardisation (ISO), they have drive the move towards a manageable set of globally
accepted management systems based standards and schemes. This move has benefited
suppliers as well, driving down costs by significantly reducing the number of audits they have
to undergo, and ensuring the audits that take place are addressing potential risks. In 2004,
ISO 22000, the first global food safety management system was issued. FSSC 22000, a
complete food safety certification scheme, was developed in 2010 to meet the needs of food

4. supply chain stakeholders. FSSC 22000 is owned by the Foundation for Food Safety
th
Certification, an independent, not-for-profit organisation. January 2012 marked the 1000
FSSC 22000 certificate being issued.
Through the harmonisation of standards, the market at large could now easily benchmark
against international standards and GFSI-recognised schemes such as ISO 22000 and FSSC
22000
As Mark Overland, Director for Global Certification at Cargill commented. “We are rolling out
FSSC 22000 to over 1,000 plants in 67 countries. Having the same level of food safety
execution at every plant is an expectation from our customers.”
Along with the Foundation for Food Safety, both the GFSI and ISO have to be applauded as
very important initiatives. The GFSI’s work on harmonising standards and schemes has
resulted in there now being only 12 approved standards from a starting point of 100, this is
clearly a significant achievement and we may expect the number will decrease in the future.
Transformation – process based approach
The second area is that of an evolving assessment approach, one driven by the strategic
needs of clients and the technical expertise of auditors, which has led to a transition in the
role of assessments and auditors. The days of “a single snapshot in time” checklist style is
fading into the history books and is being replaced with dynamic process-based management
systems audits. Delivered through auditor competency and sector specific expertise, these
audits focus on the systems and processes that strategically underpin organisations and their
supply chains, and it is this holistic approach that is gaining a foothold amongst retailers,
manufacturers and suppliers.
As LRQA client ACP Europe explains, food safety is embedded in their culture. As a
specialist in the provision of carbon dioxide, ACP cannot afford any food safety issues.
“FSSC 22000 delivers a whole new approach to risk management and quality assurance,”
explains Mr Speelmans, Safety Health Environmental Quality Manager “Through LRQA
Business Assurance, the whole network of interacting processes is assessed and monitored
thus providing greater assurance to both internal and external stakeholders and protecting our
brand reputation.”
Whilst FSSC may have come in for some criticism for being costly, the cost savings in real
terms are potentially huge and the value of harmonisation is clearly supported by Wrigley, a
subsidiary of Mars, Incorporated, who stated that, 'Wrigley's North American factories saw on
average a 25-50% reduction of audits by retailers with the adoption of FSSC 22000.'

5. In direct opposition to the holistic approach embedded into FSSC 22000, the certification
body that undertook the audit at Jensen Farms which lies at the heart of the Lysteria outbreak
commented that “the audits are intended to assess whether the client’s operations are in
compliance with current baseline industry standards—not to improve those standards or push
a client towards best practices.” This is a crucial difference with the management system
audit approach where improvement and best practices are a significant part of the process.
Transformation – auditor competency
A thorough and probing certification process can only be led by auditors with in-depth
knowledge and sector-specific expertise who are able to help organisations minimise risks,
improve systems and processes and delivers confidence for stakeholders throughout the food
supply chain. Martin Bucknavage, member of the Department of Food Science at
Pennsylvania State University, reviewed two of the audits conducted at the Georgia Peanut
Factory plant. His findings included:
• Manufacturers need to be more critical of audits, including determining “What are the
credentials of the auditor?” and
• “Are they familiar with the type of processing operation they are auditing?” and finally
• “Did they evaluate all of the risks associated with that type of operation and the type
of product they make in performing the audit?”
The integrity of the audits and the integrity of the certificate are of the utmost importance. As
Cor Groenveld, Global Product Manager Food Services at LRQA recently commented; “I truly
believe that these can only be delivered by a trained auditor who knows audit skills but also
who knows the sector. I think that this is often a weak spot and we have seen too often with
other companies in other certification bodies, that auditors do not have enough knowledge of
the sector they are auditing so making sure that the auditor has that knowledge is crucial -
that is a starting point.”
The second thing that is really important is that an auditor has to ensure that he really looks
in-depth at the corporate objectives and strategies and understands the vision of the
company. From there the auditor needs to find out what are the real risks in the organisation
and the processes and try to focus on these risks. It has to be a risk-based approach, which is
the only way that an auditor can do an effective audit. Essentially an effective auditor needs to
be bilingual – they need to be able to speak the language of the shop floor as well as that of
the board room to achieve a complete understand of an organisation.
Thirdly, the certification process has to be linked to driving improvement. Again, the technical
expertise of the auditor and the certification has to support the company to drive continuous
improvement. An auditor can challenge the organisation, without being a consultant of
course, and support the organisation by doing a robust and an in-depth audit.

6. Finally, and with criticism being levied at the auditing process that sparked the Cantaloupe
Lysteria outbreak last year, the point needs to be made that what happened at Jensen Farms
was a second party audit. There is widespread lack of understanding on the difference
between a second party and a third party audit. The official definition according to the
nd
International Register of Certified Auditors (IRCA) is that a 2 Party Audit relates to audits of
contractors/suppliers undertaken by or on behalf of a purchasing organisation. IRCA goes on
rd
to define 3 Party Audits as audits of organisations undertaken by an independent
certification body or registrar or similar third party organization. What happened at Jensen
rd nd
Farms was not a 3 party assessment but a 2 party audit because it was done to a Primus
standard not a certification standard or scheme.
Transformation – the role of certification
The responsibility for driving positive change across the food supply chain is not solely the
responsibility of regulators, retailers and manufacturers. Certification bodies have a vital role
to play in bringing confidence to the stakeholders of assessment and certification. With
organisational objectives focused on delivering safe food, at LRQA, we take our responsibility
seriously as do many of our counterparts within the certification industry. We are actively
driving change by putting in place the mechanisms to effectively train our existing assessors
to ensure that their sector and technical expertise is maintained and enhanced. In parallel,
we are continuing to invest in recruiting new assessors to ensure that we can meet the
‘stakeholder demands of tomorrow.’
But who governs the certification industry? Well, ISO/IEC 17021: 2011 - the standard for
certification bodies - ensure that the regional or country-specific accreditation bodies assess
the certification industry against a consistent standard. It has also extended the competence
requirements to encompass all staff engaged in the certification process. ISO/IEC 17021 has
clear benefits for certification bodies that are looking to set themselves apart through their
transparency, expertise and independence. For these reasons ISO/IEC 17021 offers
tangible, consistent benefits that translate into increased trust and confidence for all
stakeholder groups.
In parallel, there are many legislative controls in countries throughout the world that that add
another layer of protection for consumers in terms of regulating the food supply chain. Yuri
Cosco, from LRQA explained further; “In Belgium, we have a system which is called Self
Checking Guides, which is government regulated. The different food sectors can set up
guidelines that have to be used as a basis for the Food Safety Management System of the
companies in the sector. The government then authorises CBs (after accreditation and the
necessary paperwork) to audit the companies with the specific guide as a basis. There are
several advantages for the companies:

7. • Financial incentive (up to €15.000 per year)
• Less government audits (which normally have to be paid)
• For some sectors, it facilitates export
This approach means that the government then can focus on companies that are not
assessed by CBs, and that are thus considered as higher risk. The government has already
done studies that point out that companies having a certified system have fewer
nonconformities from the government during official inspections.
Influential organisations in food are helping to position food safety management systems
firmly on the corporate and regulatory agenda. LRQA’s key alliances with organisations such
as the GFSI and the Foundation for Food Safety will deliver added value to clients through
technical insight and enable us, along with other major certification bodies to extend their
sphere of influence. Referring to the calls by the FDA for reforms to third party auditing, Vel
Pillay Food Safety Programme Manager LRQA Americas made an insightful remark; “There is
a general lack of understanding in the difference between certification and accreditation. If
we take the FDA as an example; initially, the FDA indicated that they wanted to become a
certification body to grant certification to third party auditors or audit body. They since have
rd
changed their statement to becoming an accreditation body to certify 3 party auditors and
audit body. Fortunately there is a group of very powerful people from the industry currently
working with FDA to educate them on the role of audit bodies and as the FDA does not have
the resources to inspect all food manufacturing institutions, this may be a way of getting more
resources from the Government akin to the Belgium model.
Commenting further on the calls for reform, Cor Groenveld, Global Product Manager for Food
Services at LRQA said; “Using GSFI recognized certification delivered by licensed and
accredited certification bodies is the way forward. Although certification will never be a
guarantee things will not go wrong, the controls put in place by using GFSI and accreditation
enlarges the level of integrity of the audits themselves and in turn the certification.”
Conclusion
At LRQA, we believe that the auditing processes, which were essentially checklist driven,
coupled with the alleged lack of relevant experience for the auditor were complicit in
producing a less than effective report, contributing indirectly to both the 2009 Peanut Factory
crisis, as well as the 2011 Jensen Farms crisis. The systems and processes of both
organisations were clearly ineffective. A robust assessment approach, one that looked at their
systems and processes, embedded continual improvement as a fundamental component and
featured a risk-based methodology would certainly have mitigated the risks to all of the

8. stakeholders of both organisations to a greater extent, including, most importantly the
consumers whose lives and health were put at risk.
LRQA have proactively worked with food safety stakeholders, including manufacturers,
retailers, suppliers and industry experts to move the food sector away from a checklist based
approach to auditing towards a process-based management systems approach. This
approach looks at the underlying systems and processes that organisations have in place
rather than the ability of that plant or factory to convince an auditor on a given day that that
they comply with a series of items on a checklist. But, it is not enough to have a strong
standard or scheme, organisations need registrars or certification bodies that;
• offer auditors that have extensive experience and proven competence in the sectors
they are auditing in
• can provide a robust process based management systems approach to auditing
• stand up to the client when non-conformities are found and finally
• help the organisations being audited to reduce risks, improve food safety
performance and link their food safety management systems objectives to their
overall corporate objectives.
What is clear is that organisations across the food supply chain, including some of the world’s
leading manufacturers and retailers, are increasingly recognising the benefits of independent
assessment and certification, not only in terms of the cost savings, but also in terms of the
benefits and value it brings. Those organisations that are prioritising potential auditor CV’s
and certification body methodology’s and credentials rather than focusing on price have
rd
clearly understood what is at stake, as well as the benefits that independent, robust 3 party
assessment can offer. This approach is helping to drive consumer and other key stakeholder
confidence as well as ultimately helping to safeguard the lives of people around the world.
On the road to food safety, this can only be seen as a positive step.
END