Home » GFSI Update: Creating a Safe and Effective Worldwide Food System
In February 2008, Walmart changed the way it does business with its private-label food and other food product suppliers by demanding GFSI—Global Food Safety Initiative—certification.
Though GFSI was launched in May 2000, it seemed to languish until Walmart became the first nationwide US grocery chain to require suppliers of produce, meat, fish, poultry and RTE foods to have factory certification using one of the internationally recognized GFSI standards. Under the GFSI program, producers of Walmart and Sam’s Club private-label and other foods sold in the US must be audited by independently trained, approved and licensed auditors who are experts in their industry.
While many processors may already be familiar with GFSI, quite a few aren’t. “Some of the feedback we get from small and medium-sized processors is that they don’t even know what GFSI is,” says LeAnn Chuboff, Safe Quality Food Institute (SQFI) senior technical director. Chuboff notes that most of these processors are in the dark until they get a letter from a customer demanding adherence to GFSI. Then a common question is, “What’s wrong with my GMP audit?”
GFSI is a non-profit foundation, created and governed under Belgian law. The daily management of GFSI is handled by The Consumer Goods Forum. The GFSI’s board of directors is drawn from major global retailers, manufacturers and foodservice operators.
GFSI’s vision is driving continuous improvement in food safety to strengthen consumer confidence worldwide. Its four objectives are to:
• Reduce food safety risks by delivering equivalence and convergence between effective food safety management systems
• Manage cost in the global food system by eliminating redundancy and improving operational efficiency
• Develop competencies and capacity building in food safety to create consistent and effective global food systems
• Provide a unique international stakeholder platform for collaboration, knowledge exchange and networking.
While most people may think of SQF 2000 or the BRC Global Standard for Food Safety as “standards,” GFSI actually calls these “schemes,” which go through a GFSI benchmarking process to become approved as a method by which a processor can be audited and GFSI certified. (Benchmarking is a procedure by which a food safety-related scheme is compared to the GFSI Guidance Document.) Every scheme must have an ownership body. For example, Safe Quality Food (SQF) is owned by the Food Marketing Institute; BRC is owned by the British Retail Consortium.
The ownership body trains auditors who analyze food plants to see if they measure up to its standards as benchmarked by GFSI. Of course, this is an oversimplification of the process, as the rigors for becoming a GFSI-qualified scheme and for qualifying auditors are quite demanding.
The four original GFSI-benchmarked schemes were SQF, BRC, IFS (International Food Standard) and Dutch HACCP, according to Maureen Olewnik, AIB International vice president, audits & technical services. “ISO 22000 was not part of the grouping and is not a benchmarked standard today,” adds Olewnik. “Currently there are 12 benchmarked standards, and one that is getting a lot of recognition is FSSC 22000. FSSC 22000 is a GFSI-benchmarked standard based on ISO 22000, but has an added prerequisite program audit called PAS 220.”
PAS 220 (Publicly Available Specification 220:2008) specifies prerequisite programs to assist in controlling food safety risks within the manufacturing process of international food supply chains; its development was coordinated by BSI British Standards. PAS 220 was developed to support management systems designed to meet the requirements specified in ISO 22000.
“One of the GFSI requirements to become benchmarked insists that any given scheme have an ownership body,” says Paul Valder, CEO, Paul Valder Consulting Inc. “Since ISO 22000 is a consensus-based standard without specific ownership, it does not qualify under GFSI. Dutch HACCP has actually been replaced with FSSC 22000, which is ISO based but better addresses the needs of the food manufacturing industry.”
SQF 1000 is a recognized, minimum food safety standard for pre-gate, on-farm producers. Many other standards have already been benchmarked or are in the pipeline for consideration. Such schemes include, for example, PACsecure, BRC Storage & Distribution, Red Meat Standards and CanadaGAP, according to Valder.
According to Jessica Wigram, GFSI senior manager, the following schemes are currently going through the GFSI benchmarking process:
• BRC Global Standard for Food Safety
• CanadaGAP (Canadian Horticultural Council On-Farm Food Safety Program)
• FSC 22000 Food Products and Packaging Materials
• Global Aquaculture Alliance Seafood Processing Standard
• Global Red Meat Standard (GRMS)
• IFS Food Version 6
• Safe Quality Food.
Does it matter which scheme a processor chooses? Certain customers may prefer a specific scheme, but GSFI’s goal is for processors’ certifications to be accepted anywhere. Its motto is “Once certified, accepted everywhere.”
According to Tom Nessen, Plex Systems senior solutions engineer, his client Cuisine Solutions chose BRC certification because it exports a lot of products to the UK. Very large processors, however, tend to choose systems based on ISO standards.
“Benchmarking to GFSI ensures ‘equivalence’ of standards, i.e., all standards contain the same elements identified within the GFSI benchmark document,” says John Petie, TUV-SUD America Inc. food safety program manager. “The benchmarking process was not designed to create a single, global standard, but rather to allow innovation and competitive development between standard [scheme] owners while meeting a core set of requirements as defined in the GFSI benchmarking document.”
Why choose to be certified?
Certainly a processor can put off becoming certified until a customer demands it. But processors should know preparation time and a higher cost are involved because, simply put, any GFSI certification is much more detailed than a standard third-party food safety or GMP audit. “The typical third-party food safety audit would last a day or a day-and-a-half at the most and would cost about $2,000,” says Robert Thrash, Process Management Consulting president. “A typical GFSI audit is going to be somewhere between two-and-a-half and three-and-a-half days and will cost around $8,000.”
Thrash says the typical time to prepare and become certified is six to eight months, but it depends on the processor’s previous audit history. For example, if a processor was already audited to some of the higher food safety standards, then it may be 80 to 85 percent ready, shortening the time to certification. If a processor is starting from scratch, the time could be much longer.
For instance, while the entire SQF process can take years to complete, Sartori Company was able to finish in a year’s time. “While prior to SQF, Sartori had safety and quality programs in place, SQF helped foster a stronger culture of accountability,” says Sara Adams, Sartori quality excellence facilitator. The cheese processor achieved an excellent rating, the highest score attainable.
Many major food corporations that have been following ISO 22000 find that FSSC 22000 is the GFSI route to follow, primarily because they already have good food safety systems in place, says John Surak, principal of Surak and Associates. FSSC 22000 provides some flexibility for these international corporations because they don’t have to adapt their programs to the prescriptive requirements of a standard.
Large multinational corporations have embraced FSSC 22000 because they already had ISO 9000 systems in place, says Jeff Chilton, principal of the Chilton Consulting Group. For example, Cargill, Nestlé and the Coca-Cola Company already understand the culture and methodology, and have adopted FSSC 22000 in conjunction with PAS 220.
GFSI helps processors get ready for FSMA
An upside to the certification process is that a processor certified to a GFSI standard will be more prepared for FDA or USDA scrutiny. “Any of the approved GFSI platforms will assist processors with FSMA,” says Warren Gilbert, FSS Corp. food safety specialist. “They are very in-depth audits that address the kind of things the FDA and USDA expect to see in a food operation. One of the additional benefits is that GFSI requires an ‘approved supplier program,’ which should help with imported goods.”
“Food safety is a national priority, especially with the Food Safety Modernization Act being signed into law,” says Jon Geisler, Wornick Foods CEO. “Much of what is mandated in the new law is required for certification from SQFI. Achieving this certification demonstrates that, through our commitment to moving food forward, our food safety and quality systems plan is best-in-class.”
Some manufacturers may need to focus on the merits of GFSI accreditation. Thrash describes a recent conversation he had with a senior manager at a large international processor that was initially concerned about the costs involved in obtaining GFSI certification. Just as Geisler suggests, GFSI can be a powerful selling tool because it says to customers that a processor will deliver a higher-quality product while managing costs and having a commitment to food safety. The processor took this approach, and his company has outrun the competition with it.
But it’s important to remember that any form of GFSI certification requires sign-on from the top all the way down to the line worker, and includes training as well. “It is important that your SQF program has multi-department ownership,” says Joel Riegelmayer, Sandridge Food Corp. senior director of food safety and quality. “It is not just a quality assurance program. Most departments in a company must participate in order for the program to be successful to continuously improve food safety.”
“When considering certification, senior management must understand that it is not as important to choose a standard, as it is to know that implementing a food safety or quality management system needs to fit with the ongoing processes and culture of the specific business itself,” says Valder. “Successful certification fundamentally requires that senior management commits to the program. Furthermore, a decision to implement a food safety and/or quality management system is a business decision and not a quality assurance decision. Everyone within the organization needs to contribute as management encourages a culture which breeds ‘food safety.’ Without a full understanding and a commitment by senior management for ‘ongoing’ resources and funds needed, these programs will not succeed,” adds Valder.
LeAnn Chuboff tells processors they will only get out of SQF what they put into it. “If your goal is to improve your process procedures and to promote continuous improvement, then that’s what you’ll get out of the certification process,” says Chuboff. If processors are going through the motions just for certification, she advises them to challenge themselves, and make sure they have all the elements in place because process improvements can be worth the effort. In the certification process, she frequently finds processors that have been using needless forms for 20 years or have processes that can be streamlined.
“Certification pushed us to document and standardize a lot of things we were doing and pointed out some things we were not doing,” says Riegelmayer. “SQF requires you to look at things beyond the scope of USDA and the FDA, and because of that, your company exceeds those regulatory requirements and reduces food safety risks even further.”
While GFSI doesn’t require electronic record keeping, there are benefits to the process and track-and-trace. According to Surak, ISO 22000 is set up to encourage electronic record keeping. One of the requirements of 22000 is to perform trend analyses, which can detect if a system is deteriorating and catch the production of bad product before it happens.
Many medium- and small-sized processors have put off technology decisions for some time, but now with the preponderance of quality schemes and certification, they’ll have to start instituting automated systems, according to Plex’s Nessen. Eliminating mountains of paperwork and using electronic record keeping can not only shorten recalls, but potentially stop bad food from getting out the door.
How do auditors prepare?
Most processors getting started on the road to certification can find an adequate supply of information on GFSI’s website and on the websites of the scheme providers such as the British Retail Consortium, Safe Quality Foods Institute, etc. All these sites also list qualified consultants, auditors and trainers. One important fact to keep in mind is: GFSI rules do not allow an auditor to be a consultant for the same processor. This is specifically a conflict of interest, according to Chilton, whose service provides both auditing and consulting.
Although the same auditing company can provide both a consultant and an auditor to the same food processor, the same person employed by that company cannot serve simultaneously as both an auditor and a consultant as it would be a conflict of interest, according to GFSI rules. Some companies like Chilton’s will not let the same person serve as an auditor and a consultant unless there is at least a two-to-three year period between the two roles.
While many consultancies and auditing firms can handle more than one scheme, the individual handling the audit must be qualified for a particular scheme. In other words, a person who is already qualified to handle BRC auditing must also be separately qualified through SQFI to handle SQF auditing. For an auditor qualified in any particular scheme, there is a long period of training, classes and exams plus meeting specialty and experience requirements, in particular food and beverage sub-categories.
For example, GFSI requires auditors to have five years of full-time experience in the food or associated industry including two years in quality assurance or food safety functions in food production or manufacturing, retailing, inspection or enforcement. Auditors take an exam covering knowledge of the scheme, relevant legislative requirements, knowledge and understanding of specific food processes, quality assurance, food safety management and HACCP. An auditor must have formal training on QMS or FSMS, HACCP and the scheme being delivered. Auditors’ skills are assessed, and they must maintain audit experience.
Chilton breaks the GFSI accreditation process into four steps as he works with processors. “We start with a gap analysis where we do an initial assessment of what types of programs a processor currently has in place compared to the GFSI standard requirements.” The gaps indicate what the processor will need to do to come into compliance.
Phase two involves program development. GFSI requires a written policy manual containing all the procedures that document how a processor complies with standards. The consultant helps the processor with this process so the end result is a written policy manual.
According to Chilton, the third phase focuses on implementation, with the consultant ensuring all record-keeping requirements and programs have been fully implemented. This includes a mock audit to be sure all gaps have been closed and the processor is actually prepared to go through the certification audit. The consultant also develops an audit strategy showing how the processor can be successful during the audit itself. The consultant coaches various departmental managers from all major areas such as operations, QA, maintenance, sanitation, and shipping and receiving.
The fourth and final phase is audit support. A consultant is onsite with the processor to address any issues that might come up and get them resolved so the processor can pass the audit the first time, preventing the need for a surveillance audit. (Surveillance audits are conducted when a regularly scheduled audit receives low scores or a processor has a recall.)
Once a processor is certified under a scheme, it doesn’t end there. Depending on the certification body, audits are conducted in some form on an annual basis. For example, according to Petie, SQF requires a first-year certification audit, second- and third-year surveillance audits and on the fourth year, a full certification audit. BRC certification audits are conducted on an annual basis.
“When there is a recall of product manufactured in a certified facility, the certification body is required to review the company’s recall effectiveness and any corrective action to prevent reoccurrence carried out by the processor,” says Olewnik. “The certification body decides if a follow-up inspection to verify effectiveness of the corrective action is required. If the procedure is not handled properly by the processor, it could be suspended from certification.”
“There are numerous recalls on a daily basis here in the US; most of them are not life threatening,” says Gilbert. “What the GFSI certification brings is a more detailed look into each and every process step of the operation. It puts those checks and balances in place to minimize the possibility of a recall.
“If processors look at certification as a learning tool, they will see things in their operation that will make them better understand their process and that will make it a much more transparent and overall smoother operation,” continues Gilbert. “The implementation process is long with a steep learning curve, but those involved in the process will have visited every step and will see the benefits of going through the certification process.”