Audits provide an essential tool for improving and verifying compliance performance. Audits may be used to capture regulatory compliance status, management system conformance, adequacy of internal controls, potential risks, and best practices.
Most regulations, standards, and guidance require audits to be conducted with some established frequency. For many companies, figuring out how to meet these audit requirements amongst travel restrictions, new company safety protocol, and government quarantines related to COVID-19 presents a significant new challenge.
The Online Alternative
Companies come in a variety of sizes with a range of different needs. Because of this, auditing standards remain fairly flexible by design. Fortunately, this allows for online/remote/virtual audits as a viable alternative to onsite audits—provided the audits:
- Are planned well;
- Appropriately leverage technology; and
- Are executed by a team who understands the facility and the requirements.
The ultimate objective of a virtual audit remains the same as an in-person audit: To obtain credible audit evidence to accurately assess compliance/conformance with identified requirements/specifications. The difference lies in the means in which that evidence is collected (i.e., live stream video, surveillance cameras, group web meetings, electronic document review).
Weighing Risks vs. Rewards
Audits can be conducted onsite, remotely, or a combination of the two. In many cases, companies may already be having portions of the audit (e.g., document review) done remotely. Moving the entire audit to the virtual world allows credible evidence to be obtained in unique ways that can offer significant benefits to a company when onsite audits aren’t possible—and even when they are:
- Reduced cost – Online audits eliminate the expenses associated with travel (i.e., mileage, flights, hotels, meals), which can add up depending on the location and duration of the audit.
- Flexible schedule – Remote audits can be conducted on a more flexible time schedule. Auditors do not have to complete work onsite in a set number of days, as is required when traveling to a facility. The auditor can also review areas in question remotely after the audit is technically over. Note that a more flexible time schedule does not necessarily mean less time involved to conduct the audit.
- Social distancing – As CDC guidelines have recommended, it is currently safest to work remotely, when possible, or to remain six feet of social distance to avoid potential transmission of COVID-19. Through the use of technology, virtual audits provide a social distancing extreme.
- Improved systems – Preparing for a virtual audit provides the “push” some organizations need to improve electronic storage systems. To conduct a virtual audit, documents and records must be retained in an organized manner that facilitates easy/quick access. Being able to access all documents remotely is necessary—paper records or documents stored on individual computers/network drives no longer cut it.
At the same time, there are some potential risks to conducting a completely virtual audit, particularly since this practice is relatively new to many organizations:
- Observation/technology limits – Observation of site conditions is limited by the ability to direct live stream video remotely. Technology can create limitations. If the camera can’t see it, neither can the auditor. Poor video quality can impede visual clarity. You don’t know what you don’t know.
- Communication confusion – It can be difficult to read body language and/or interpret emails and phone conversations to make sure communication is clear. This can require revisiting topics/findings several times to ensure accurate evidence is collected.
- Time barriers – There may be time zone and associated scheduling barriers depending on the location of the auditor and the facility.
Considerations and Best Practices
Regardless of the type of audit a facility conducts (i.e., remote, onsite, combination), standard audit best practices should be followed to ensure that audit results are comprehensive and credible. If the company opts for a virtual audit—for any reason—there are a number of considerations and best practices to ensure that the audit effectively fulfills its objectives and alleviates the risks outlined above to the extent possible:
- Site Familiarity – Virtual audits work best if auditors are familiar with the industry and/or operations. While it is not necessary for the auditor to have visited the site before, that type of familiarity with the facility provides the best-case scenario, especially for compliance audits, as it prepares the auditor to know what to look for (and where) and what questions to ask.
- Careful Planning – Much like onsite audits, virtual audits require careful upfront planning on the part of the auditor and the facility—and perhaps to an elevated degree.
- The facility needs to collect all documents and records prior to the audit and determine best way to present that information remotely (e.g., email/transfer ahead of time, allow access to company Intranet/shared directory space, share during a web meeting).
- Interviews are best scheduled in advance to ensure availability; however, they can be conducted on an ad hoc basis as need arises.
- It is best to plot out route and areas of specific focus for the audit ahead of time using a site map as a guide to ensure that all areas are covered and that the audit can be conducted as efficiently as possible using the allocated facility resources. An audit site guide must be assigned who is familiar with the entire facility.
- Technology needs and requirements must be evaluated, and logistics and access should be tested prior to the audit. It is vital that all cameras, web meetings, shared document space, WiFi, and other technology is working appropriately prior to the audit or a lot of time can be wasted troubleshooting issues.
- Video – Videos should be live. Site walks should be led by a site guide/employee along the planned route with smart phones, iPads, etc., with live streaming capabilities. It is important to ensure that live streaming works within the facility being audited so auditors have a clear view of site conditions. Auditors can also take advantage of any in-house surveillance cameras (e.g., security or quality systems) to provide additional footage of operations, when necessary. In most cases, surveillance footage cannot replace live video.
- Web Meetings – Opening, closing, and daily briefings can be conducted via web meeting. Remote audits provide the flexibility to conduct the audit in segments, with briefings following each segment. This allows the auditor to review video footage, evaluate records, and generate questions to ensure the information collected is accurate and complete.
Companies all over the world are working through a transition period right now, where they are trying to establish what a new “normal” looks like when it comes to operating practices, employee health and safety, business continuity, and compliance. Audits are one piece of the overall puzzle that can be transitioned somewhat seamlessly with the right planning and technology in place to ensure ongoing compliance.
The FDA’s Intentional Adulteration Rule is aimed at preventing intentional adulteration from acts intended to cause wide-scale harm to public health, including acts of terrorism targeting the food supply. This is an incredibly important topic for the food industry to understand.
Webinar: Intentional Adulteration & Food Defense
May 20, 2020 | 2:00 – 3:00 p.m. ET
While there are a number of Food Safety Management Systems available today to prevent accidental contamination, a deliberate attack can often bypass food safety protocols–getting past even the most rigorous systems. Fortunately, there is a “how-to” guide available for the food industry called PAS 96, which is intended to help protect and defend food and drink from deliberate attack.
During this webinar, our speakers will highlight the following:
- Introduction to Intentional Adulteration & Food Defense
- Requirements of the FDA Intentional Adulteration Rule
- How to build a Food Defense strategy
- How using PAS 96 will help to reduce the likelihood and impact of a deliberate attack
- How you can get your free downloadable copy of PAS 96, Guidance on Food and Drink Defense
The following information outlines provisions the GFSI-benchmarked schemes are taking to account for audit disruptions due to COVID-19, as of April 21, 2020.
Re-Certification Audits (V5 upgrade audits)
- A risk assessment will be completed.
- The decision from the risk assessment could lead to extension to the current V4.1 Certificate of up to 6 months.
- The full V5 re-certification audit will need to take place within 6 months.
- The new V5 certificate will have dates aligned with the current certification cycle.
Surveillance Audits (V5 upgrade audits)
- A risk assessment will be completed.
- The decision from the risk assessment could
- Maintaining the current V4.1 Certificate
- Suspending the V4.1 Certificate
- Postponement of the surveillance/periodical V5 upgrade audit by a maximum of 6 months.
Where the site is operational, but a physical audit cannot occur on or before the due date and will result in an existing certificate expiring, a certificate extension of up to 6 months validity may be issued based on:
- The successful completion of a risk assessment by the certification body confirming it is appropriate to continue certification.
- The certification body completing a discussion
with the site and review of procedures in place to establish the impact of
COVID-19 extraordinary circumstances to the site operations and the effective
implementation of an emergency response plan.
- Certifications can only be extended by the current certification body.
- Sites with C & D grades may not be extended.
- For BRCGS Packaging, any extended certificates will be against Version 5.
IFS is subject to the decisions of local authorities and cannot provide a general statement (each situation need to be assessed individually). In the case that an audit cannot be performed on time:
- This will result in the certificate not being renewed.
- An exceptional extension of the existing IFS Certificates is not possible.
Due to precautions taken by local authorities, it may not be possible to carry out audits. In this case, existing IFS certificates remain valid until the end of their term and then lose their regular validity.
IFS appeals to retailers and their suppliers to contact and find bilateral solutions so that supplier contracts can be maintained. The IFS will make it visible in the database if IFS certificates could not be renewed due to COVID-19.
A certifying body can request to SQF for a site to have a one-time 6-month extension from the certificate expiration date.
- Request may not occur until site is within the audit window of the audit.
- Certifying body will conduct a risk assessment to understand and determine if there is a need to extend the certificate following the IAF Informative Document for Management of Extraordinary Events or Circumstances Affecting ABs, CABs, and Certified Organizations (IAF ID 3:2001).
- Certifying body will submit a change request and Notification Form to SQF for approval.
- Requests will be considered by the SQF Compliance Manager in consultation with the technical team and applicable certifying body and/or legal counsel.
- If the risk assessment identified a low risk of continued certification for a site, SQF will approve and certifying body will extend the expiration date for 6 months from the recertification date.
- Sites that are in the process of switching to a new certifying body, the certifying body that holds the current site’s certificate will be required to conduct the risk assessment to determine the risk level to the existing certificate.
- Unannounced audits can be waived up to 5/31/2020. Any waived must be conducted in 2021.
KTL will continue to track these changes and their impacts on the food industry. We hope KTL can be a trusted resource on many levels now and as we eventually return to “business as usual”.
At the most basic level, a root cause is the fundamental reason—or the highest-level cause—for the occurrence of a problem, incident, or event. The root cause sets in motion the entire cause-and-effect reaction that ultimately leads to the problem. Getting to the root cause of any problem is important not just for resolving the issue at hand, but for identifying underlying issues to ensure that similar problems do not occur in the future. This starts with a process called the root cause analysis (RCA).
What Is the Root Cause Analysis (RCA)?
A root cause can be permanently eliminated through process improvement. RCA is a method of problem-solving used to identify the underlying (i.e., root) cause(s) of a problem/incident. RCA can be used to solve problems and provide preventive actions for:
- Major accidents
- Everyday incidents
- Minor near misses
- Human errors
- Maintenance problems
- Medical mistakes
- Productivity issues
- Manufacturing mistakes
- Environmental releases
- Risk analysis, risk mapping
RCA is a systematic process based on the basic idea that effective management requires more than merely putting out fires. RCA focuses on finding a way to prevent these fires from recurring. Rather than just treating symptoms, RCA seeks to identify and address the true, underlying concerns that contribute to a problem or event.
Why is this important? If you just treat the symptoms of the problem, that alleviates them for the short term, but it does nothing to prevent the problem from coming back again. Lasting solutions address the underlying factors—the root cause(s)— that create the problem in the first place. Targeting corrective measures at the identified root causes, subsequently, is the best way to alleviate risk and ensure that similar problems do not occur in the future.
Both the Occupational Safety and Health Administration (OSHA) and Environmental Protection Agency (EPA) encourage organizations to conduct RCA following an incident or near miss at a facility. In fact, facilities covered by OSHA’s Process Safety Management (PSM) standard are required to investigate incidents that resulted in (or could have reasonably resulted in) a catastrophic release of highly hazardous chemicals. Similarly, EPA’s Risk Management Program (RMP) regulations require regulated facilities to conduct incident investigations. In addition, certain management systems, including ISO and Responsible Distribution (National Association of Chemical Distributors) to name just a few, also require RCA.
Whether an organization is subject to PSM, RMP, or management system standards, identifying the root cause of any incident or problem through RCA is a best practice that can significantly benefit organizations by identifying underlying issues to ensure that similar problems do not occur in the future. So, how do you effectively implement RCA?
RCA can be broken down into a simple six-step process, as outlined below.
Step 1: Identify and Clearly Describe the Problem
The first step is to understand and document the problem/issue/incident that actually occurred. This might involve interviewing key staff, reviewing security footage, investigating the site, etc. to get an accurate account of the issue. Certainly safety- or security-related incidents might require an immediate fix or prompt action before the carrying out the complete RCA. This is always the first priority.
Some problems are easier to define than others based on what happened and the extent of the issue. When defining and describing the problem, it is important to be as descriptive as possible, as this will aid in future steps to identify the root cause(s).
For example, the first description below is somewhat vague. The second description provides an additional level of detail that more fully documents the situation:
- A forklift driver wasn’t wearing his seatbelt. (vague)
- During a walkthrough of the warehouse on 2/1/20, it was observed that forklift driver John Smith, who is a contract employee, was not wearing his seatbelt while operating the forklift. (clear)
Step 2: Identify Possible Causes…Why?
There are several methods for identifying possible root causes. One of the most common is known as the “5 Why Method”. This approach simply involves asking the question “Why” enough times (i.e., five times) until you get past all the symptoms of a problem and down to the underlying root cause of the issue. The detailed problem description put together during Step 1 serves as the starting point for asking “Why”.
Let’s take our problem description from above a step further to identify the possible causes using the 5 Why Method.
At this point, the 5 Why Method is leading you to the core issue that set in motion the entire cause-and-effect reaction and, ultimately, that led to the identified problem(s). It’s now time to determine whether the five whys have dug deep enough. Where does your questioning lead you? Is there one root cause or are there a series of root causes contributing to this incident? Often, there are multiple root causes that may be factors to address when preventing future incidents.
In our forklift operator case, the 5 Why Method points to the lack of a standardized checklist of all items to be trained on—including forklift training—prior to a new contract employee coming onsite.
Step 4: Corrective and/or Preventive Action Taken
Based on the identified root causes, it then becomes possible for the facility to determine what corrective and/or prevention actions (CAPAs) can be taken to fix the problem and, just as important, prevent it from occurring in the future. For our example, there are a number of potential CAPAs:
- Stop the employee from operating the forklift and educate him on seatbelt policy prior to resuming work
- Review contract/temp employee training program
- Retrain shift managers on training expectations
- Obtain training records for contract/temp employees
- Provide refresher/retraining, as necessary
- Add signage to forklifts and warehouse bulletin boards about seatbelt policy
Step 5: Analyze Effectiveness
The effectiveness of whatever action is taken in step 4 needs to be evaluated to determine whether it will resolve the root cause. If not, another CAPA should be explored, implemented, and analyzed to assess its impact on the issue/problem. If it is a root cause, it should help to resolve the issue and you should move on to step 6 below.
Let’s return to our example. You might ask, “Was the retraining effective?” An evaluation shows the following:
- Yes, the employee continues to operate the forklift using seatbelt.
- Yes, subsequent walkthroughs of the warehouse over the next six months have not resulted in any additional seatbelt violations.
- The next contract/temp employee brought on to assist during the busy end-of-year season was required to produce current training.
Step 6: Update Procedures, as necessary
As CAPAs are implemented, once they prove effective, related policies and procedures must be updated to reflect any changes made. This step ensures the outcomes of the RCA will be integrated into operations and used to prevent similar incidents from happening in the future.
In our current example, this might mean that the Contractor Policy is updated to include a new section specific to the hiring of contract/temp employees with the following requirements:
- Obtain valid training certificates for work performed
- Ensure Managers conduct on-the-job training for contract/temp employees specific to work performed
Benefits of RCA
Following these six steps will help to ensure a thorough investigation that identifies the root cause(s) versus just symptoms is conducted. It further ensures that any changes related to the root cause are integrated into the organization to prevent similar events from happening again. In the end, the RCA process can help:
- Reduce the risk of injury and/or death to workers and community members
- Reduce the potential for environmental damage
- Avoid unnecessary costs resulting from business interruption; emergency response and cleanup; increased regulation, audits, and inspections; and OSHA or EPA fines
- Improve public trust by maintaining an incident-free record
- More effectively control hazards, improve process reliability, increase revenues, decrease production costs, lower maintenance costs, and lower insurance premiums
Many food companies face challenges when it comes to sanitation and hygiene, particularly after periods of shutdown or emergency response when the company returns to “business as usual”. Join Kestrel Tellevate LLC (KTL) Principal Bill Bremer and DNV GL for a free webinar that will provide guidance to keep your company safe and in compliance.
Maintain Your Plant, Equipment & Personnel Sanitation Following Shutdown Periods
April 30, 2020 | 10:00 – 11:30 a.m. CT
This webinar will focus on sanitation and hygiene best practices for building, equipment, personnel areas, personnel, and employee welfare as it relates to startup for pre-operations following shutdown or emergency response periods. Each area will be described, along with the related sanitation/hygiene issues, concerns, possible impacts, risks, inspection, observation, and controls.
Topics covered in the webinar include the following:
- Various methods of sterilization, sanitation, and disinfection
- Potency in killing germs and unknowns of efficacy
- Applicability in manufacturing, processing, holding, and for various sizes of packaging
- Advantages and disadvantages of inspection types (e.g., visual, odor, physical state)
- Recommendations to achieve effective results with Environmental monitoring (EM) programs
- Considerations for expanded programs based on the re-start situation
- Documenting the sanitation processes
- Responding to unanticipated testing or observations
KTL recently announced our partnership with Martin Mantz Compliance Solutions (Martin Mantz), developer of the GEORG Compliance Management System® software. KTL is providing regulatory compliance expertise to the German-based company as it expands its offerings to clients with operations in the United States.
In this recent article, our partners at Martin Mantz discuss how Rudolph Logistics Group, an international logistics service provider from Germany, is using GEORG as a compliance solution to provide employees clear information in accordance with ISO standards on:
- Tasks – what they have to do
- Responsibilities for implementation – who needs to do it
- Date/time of completion – when it needs to be done
- Description of the way the task is to be performed – how the task must be fulfilled
The objective is to simplify requirements to the extent possible so employees can focus on tasks to be completed without needing to interpret complicated and extensive guidelines. Read more…
Comments: No Comments
KTL is pleased to announce our partnership with Martin Mantz Compliance Solutions (Martin Mantz), developer of the GEORG Compliance Management System® software. KTL is providing regulatory compliance expertise to the German-based company as it expands its offerings to clients with operations in the United States.
“Martin Mantz has created something unique with the GEORG software in that it simplifies and provides an interpretation of legal and technical requirements in a customer-specific database,” KTL Principal Lisa Langdon states. “KTL’s understanding of industrial operations, as well as U.S. legal and technical requirements (e.g., EPA, OSHA, FDA, ISO), allows us to translate these requirements into simple tasks in the GEORG system that employees can follow to help fulfill regulatory requirements.”
How GEORG Works
GEORG is used to make the requirements of standards and regulations comprehensible and transparent. KTL specializes in the practical mapping of legal requirements and audits. These audits allow KTL to create technical content for the GEORG system based on facility-specific applicability. We then work directly with the company to delegate the identified tasks. If there are revisions in the standards/regulations, KTL works in the system to ensure tasks are updated to meet regulatory requirements.
The benefits of this approach include:
- Effectiveness – All tasks are assigned, easily formulated, and regularly updated.
- Efficiency – The effort and expertise required to understand complicated regulations is reduced.
- Transparency – Responsibilities are clear and easily visible to all employees.
- Conformity – Compliance status within the system reflects the degree of fulfilment of the related requirements.
Faber-Castell Expands GEORG Implementation to U.S. Subsidiary
Faber-Castell Cosmetics, an internationally renowned Martin Mantz customer with worldwide operations, is already benefitting from the Martin Mantz-KTL partnership. After successful implementation of the GEORG software in their German facilities, Martin Mantz has worked with KTL to expand usage to Faber-Castell’s subsidiary in the U.S.
About Martin Mantz Compliance Solutions
Martin Mantz Compliance Solutions, based in Grosswallstadt and Leipzig, Germany, offers its contractual partners services in the area of legal organization (GEORG) of companies to avoid organizational negligence and compliance violations. This includes consulting and provision of the compliance software GEORG Compliance Management System®, implementation of the technical and legal modules, as well as construction and maintenance of the customer-specific database. https://www.martin-mantz.de/
About Kestrel Tellevate LLC
KTL is a multidisciplinary consulting firm that specializes in providing environmental, health, and safety (EHS) and food safety management and compliance consulting services to private and government clients. Our primary focus is to build strong, long-term client partnerships and provide tailored solutions to address regulatory requirements. KTL’s services include management system development and implementation, auditing and assessments, regulatory compliance assistance, information management solutions, and training. KTL is a Small Business Administration-registered company with headquarters in Madison, WI and Atlanta, GA and offices across the Midwest and Washington, D.C. www.kestreltellevate.com
Food Intentional Adulteration:
Vulnerability Assessment Training
April 21, 2020 | 8:30 am – 5:00 pm
Courtyard by Marriott – Chicago O’Hare
2950 S. River Road | Des Plaines, IL
On July, 26 2016, the final rule for Mitigation Strategies to Protect Food Against Intentional Adulteration was released as part of the Food Safety Modernization Act (FSMA). This rule defines the requirements for facilities manufacturing, processing, handling, packing, and storing food products to protect food against acts intended to cause wide-scale public harm to consumers.
The regulation requires all facilities handling food products to complete a vulnerability assessment for their processes. Based on results, facilities are then required to implement mitigation strategies against potential threats (e.g., terrorism, tampering, sabotage).
Kestrel Tellevate LLC’s (KTL) Intentional Adulteration Vulnerability Assessment Training is a one-day course designed to train responsible Food Defense Qualified Individuals to understand the current requirements to protect against intentional adulteration.
This course will focus on the the vulnerability assessment approach, according to the FSMA regulation. The Food Defense Qualified Individual will learn strategies to:
- Implement the Food Defense Plan
- Perform the vulnerability assessment
- Define mitigation strategies
- Conduct periodic review of the Food Defense Plan
Participation in this course will help to ensure compliance with the requirements outlined in the Intentional Adulteration Rule to protect against food adulteration.
KTL is pleased to welcome CSQA Foreign Affairs Manager Carlo Merlo as our instructor for this course. Carlo is a Lead Instructor for Intentional Adulteration Vulnerability Assessment.
To ensure companies uphold standards (internal or external) and continuously improve performance, audits are critical. In short, there are three primary purposes of auditing:
- Verify conformance with the standard/requirement – Are we doing what the standard/requirement says we must do?
- Verify implementation of stated procedures – Are we following the steps in our documented procedures?
- Evaluate effectiveness – Are we accomplishing our goals and objectives?
For an audit to be effective, appropriate mechanics must be in place when it comes to planning, execution, and reporting.
As with most things, your execution will only be as good as your plan. All good audits must begin with planning. This involves everything from planning for your team, to planning out the scope of the audit, to planning all the associated logistics.
Auditors: Who Is on the Team?
Depending on the size and complexity of the audits, audit teams need to be selected. These individuals must be independent of the area being audited and trained in the basic elements of the facility’s management system and/or programs. Team members will be led by a trained auditor. The auditor’s responsibilities include the following:
- Comply with and communicate audit requirements
- Prepare working documents under the direction of the Lead Auditor
- Plan and carry out the assigned responsibilities within the scope of the audit
- Collect and analyze evidence to draw conclusions
- Document audit observations and findings
- Report audit results to Lead Auditor
- Retain and safeguard audit documents
- Cooperate with and support the Lead Auditor
- Assist in writing the report
As indicated above, one person on the team is typically designated the Lead Auditor. This individual will coordinate audit assignments and address any questions/concerns that may arise. Specifically, the Lead Auditor has the following responsibilities:
- Assigns team members specific management system/program elements, functions, or activities to audit
- Provides instructions on the audit procedure to follow
- Makes changes to work assignments, as necessary, to ensure the achievement of audit objectives
Audit Objectives, Scope, and Plans: What Are We Auditing?
The audit is all about:
- Conformance – auditing sections of the standard/requirements to determine if the system conforms
- Implementation – auditing work instructions to see if they are being followed
In determining the audit scope, it is importation to define what is to be audited (e.g., policy, planning, implementation, checking/corrective action, management review). If the organization has more than one physical location, the scope may outline what physical locations and/or organizational activities are to be audited (e.g., production lines or departments). These factors will ultimately also help determine the length of the audit.
Logistics: How Are We Going to Do This?
There are many things to factor into the audit from a logistical standpoint for it to go smoothly. Safety should always be of utmost concern. What precautions do auditors need to take? Is there any PPE that might be necessary? Do auditors need any special safety training introduction or training before conducting the audit? Consider the facility. Auditors need to understand the operation/activity being audited. In line with this, the auditor must also have an understanding of whether there is any equipment or special resources needed, ranging from technical support (e.g., tablets, smartphones) to lunch. Finally, it is important to make sure there are no conflicts of interest when it comes to the auditor and the facility that is being audited.
Once planned appropriately, audits should be conducted according to the program elements. Interviews and objectives evidence will both provide the support needed to conduct a valid audit.
The auditor must know in advance which elements are being covered in an audit so he/she can:
- Control the pace of the audit.
- Guide the course of the audit.
That being said, additional audit activities should not be restricted if other issues arise.
Auditing should only be done against current controlled work instructions or procedures related to the program elements. Procedures that are being used in the field must be verified. Historical and/or uncontrolled procedures should not be used.
Auditors must remember that they are creating a record. Notes should include statements, document numbers, identifiers (e.g., department, area), positions. Common pitfalls to be avoided in taking notes include abbreviations, no location identifier for observations, no document references, illegible, pejorative, cryptic. These things all impact the credibility of the audit.
The goal of an interview in the audit is to obtain valid information. However, how questions are asked will impact the answer. Auditors must prepare and know what questions need to be asked and how to ask them in advance of the audit. Creating an atmosphere of trust and open communication is key to getting open and honest responses. Remember, the goal is to audit the system, not the interviewee.
The following are good rules of thumb for conducting effective audit interviews:
- Direct questions to the person who does the job, not to the supervisor.
- Never talk down to anyone.
- Speak the person’s language.
- Speak clearly and carefully.
- Use who, what, where, when and why in your questioning vs. can or does.
Objective evidence provides verifiable information, records, or statements of fact. This is vital in any audit report. Objective evidence can be based on any of the following:
- Examination of documents
- Observation of activities and conditions
- Results of measurements
- Other means within the scope of the audit
Evidence should be firsthand evidence based on witnessed fact, not supposition, presumption, hearsay, rumor, or conjecture. It can be qualitative or quantitative, but it should be repeatable.
Findings form the basis of the report. Findings can be classified in one of two ways:
- Nonconformance is the observed absence of or lapse in a required procedure or the total breakdown of a procedure that can cause a negative impact on the organization’s environmental performance. These can fall into a few categories:
- Does not meet the requirements of the standard. This may include issues identified with records, procedures, work instructions, and use of controlled documents.
- Is not fully implemented. Most commonly, these implementation nonconformances may relate to training, communication, and documentation.
- Is improperly implemented. This is often demonstrated by worker lack of understanding, improper implementation of written work instruction, or missing stated required deadlines.
- Opportunity for improvement is just that—an opportunity to improve management to either reduce impacts, minimize legal requirements, prevent future nonconformances, or improve business performance.
The following examples and tips can serve as guidelines for writing useful and more concrete findings that will the company to identify opportunities for improvement:
- Do not overstate conclusions.
- Poor: The procedure for handling spent light bulbs is being ignored.
- Better: Three spent fluorescent bulbs were found in the general trash.
- State the problem clearly and exactly.
- Poor: Instruments are not being calibrated.
- Better: The sampling and analytical instruments in the wastewater treatment plant are not calibrated.
- Avoid generalities.
- Poor: The area’s empty drum management process is inadequate.
- Better: The hi-lo driver in the area handling empty drums was not trained on hazardous material handling.
- Communicate the extent of the problem fully.
- Poor: All cardboard in the catalytic converter area is being sent to the compactor.
- Better: None of the cardboard in the catalytic converter area was being stored and/or evaluated for reuse as dunnage.
- Do not focus on criticisms of individuals.
- Poor: Jim Jones had no understanding of the safety policy.
- Better: Discussions with several employees indicated that the safety policy was not fully understood.
- Give specific references.
- Poor: Hazardous waste area inspections have not been conducted.
- Better: Weekly hazardous waste storage area inspections (VMEWP-008) have not been conducted since June 2002.
- Avoid indirect expressions.
- Poor: There were occasions when the reports were not filed on time. It appears the air monitoring equipment is not calibrated.
- Better: Reports were filed late on ten occasions in 2002. There were no records of air monitoring equipment calibrations for 2001 or 2002.
Audits are a skilled activity. They provide the basis for assessment of conformance and, correspondingly, company actions to improve performance. For audits to be valuable, however, the audit process must be consistent and controlled. Clearly and correctly documented nonconformances lead to appropriate corrective actions—the mechanism for translating audits into improvements.
Kestrel Tellevate is seeking a junior-level Consultant with 5-7 years of professional food safety consulting or relevant food industry experience to join our food safety team. This individual will be responsible for executing projects tasks and objectives for KTL’s food safety projects, according to Project Manager, Senior Consultant, and client expectations. The Food Safety Consultant must have working knowledge of FDA, USDA, and GFSI requirements as they apply to food manufacturing, processing, and distribution, and experience implementing/maintaining food safety documents and plans.
Responsibilities and tasks include the following:
- Providing HACCP, SOP, SSOP development and implementation support
- Conducting gap assessments to FDA, USDA, GFSI (i.e., IFS, BRC, FSSC22000, SQF) requirements
- Conducting relevant food safety training for clients
- Researching FDA, USDA and GFSI regulatory requirements and maintaining standards updates
- Researching labeling regulatory review
- Interpreting third-party regulatory audits
- Reviewing, recommending, and coordinating efforts for environmental pathogen testing program
- Working with clients and KTL senior staff to identify gaps and implement solid solutions for continuous improvement
- Maintaining and updating documents to ensure consistency
- Participating in the development of KTL’s SharePoint tools
- Participating in the implementation of KTL’s Quality Management System (QMS)
- Assisting in growing clients and other business development efforts, as requested
- B.S. degree in Food Technology / Microbiology or other related life science
- 5-7 years of related food industry experience in Quality Assurance/Control; experience in cooking, processing, dairy, low-acid canned food, meat or seafood preferred
- Excellent communication and presentation skills
- Strong computer knowledge
- Ability to travel up to 50%
- High-risk food experience
- Understanding of food safety in food packaging
How to Apply
Forward a resume to firstname.lastname@example.org.