PrimusGFS Audit Food Safety Management Systems (Module 1) Guidelines

Transcription

1 PrimusGFS Audit Food Safety Management Systems (Module 1) Guidelines Used in conjunction with PrimusGFS v2.1 audit Edition v1. March 214 PrimusGFS (owned by Azzule Systems, LLC) 252 Skyway Drive, Suite A Santa Maria, CA Page 1 of 32

2 Index Audit Execution 4 Audit Scoring 4 Automatic Failure 7 Documentation Requirements 7 Glossary 9 Module 1 11 Management System 11 Control of Documents and Records 14 Procedures and Corrective Actions 16 Internal and External Inspections 17 Rejection and Release of Product 2 Supplier Control 23 Traceability and Recall 26 Food Defense 29 Page 2 of 32

3 This document is for guidance purposes only and in no way replaces any regulatory legislation or other legal guidance documentation or viewed as giving legal advice. PrimusGFS (the Scheme), owned by Azzule Systems LLC accepts no liability for the contents of this document, nor how an individual chooses to apply this document. This document is owned by Azzule System LLC and as such must be not be copied in whole or in part for any other use. Under no circumstances can this document be copied by or to any person without Azzule System expressed permission. These guidelines help interpret/support the principles, requirements and expectations of the PrimusGFS v2.1 Food Safety Management Section (Module 1) as noted in the Scheme normative documents. These guidelines are neither exhaustive nor exclusive and detail minimum requirements only by means of statements related to audit questions and expectations. There will be variations in applicability to an operation based on the process(es) and commodities involved. Auditors and auditees should interpret the questions and criteria in different situations, with the food safety and risk minimization being the key concerns. The operation practices, policies and procedures should be pertinent to the situation at hand and be able to stand up to any challenge by an auditor or other relevant interested party (including law enforcement). Where laws, customer requirements and specifications, commodity specific guidelines and/or best practice recommendations exist and are derived from a reputable source these practices and parameters should be followed if they present a higher level of conformance/compliance than those included in the audit scheme system. Website links shown in this document are there to aid understanding and provide assistance. These links are not a sign of endorsement by Azzule. Furthermore Azzule Systems accepts no liability for the content of these links. Please be aware that there is additional information on the PrimusGFS website including the actual audit templates. The Primusgfs website also has access to the official PrimusGFS General Regulations which explains the overall scheme scoring systems and other details of the scheme Page 3 of 32

4 The following is a modified excerpt from PrimusGFS General Regulations v2.1. It is provided here as an introduction to the audit notes. For full and current text please refer to the most recent version of PrimusGFS General Regulations at Audit Execution The audit should be performed using the most recent version of the PrimusGFS normative documents. The PrimusGFS Standard is divided into three Modules: Module 1 - Food Safety Management System Module 2 - GAP and/or GMP options Module 3 -HACCP program Each Module is divided into sections, related to the specific Module and each section includes questions that detail the requirements for the specific section. Please note, with all operations it is imperative that the facility is running product i.e. processing, packing, cooling (whatever functions are usually occurring as on a normal day) and that a normal compliment of personnel are on site when the audit occurs in order for the auditor to complete a valid assessment. Scoring System The audit format is updated as needed. This may include the layout, the questions themselves and point assignments. The following is the scoring system used for the PrimusGFS audits: Module 1 Food Safety Management System Possible answers: Module 2 GAP Option GMP Option Possible answers: Possible answers: Module 3 HACCP Possible answers: Total Compliance Minor Deficiency Major Deficiency Non Compliance Non Applicable Yes No Not Applicable Total Compliance Minor Deficiency Major Deficiency Non Compliance Non Applicable Total Compliance Minor Deficiency Major Deficiency Non Compliance Non Applicable Page 4 of 32

5 For questions in Module 1, Module 2 GMP option and Module 3, the amount of deficiencies and the associated risks have to be considered to assign the severity of the finding, which can be Minor Deficiency, Major Deficiency and Non Compliance. When no deficiencies are found, a Total Compliance is given. Some general statements for the scoring decision are described in the table below. These statements are superseded by the criteria described in the question s expectations and users should be aware that some questions do not follow these general statements e.g. automatic failure questions. The possible answers to the questions in each Module are listed in the following table: Scoring system for questions in Module 1, Module 2 GMP option and Module 3 Possible answer Possible Points for the question Total compliance Minor deficiency Major deficiency Non-compliance Not applicable For questions in Module 2 GAP option, the scoring system is described in the table below: Scoring system for questions in Module 2 GAP option Possible answer Possible Points for the question Total compliance (may be Yes or No) Non-compliance (may be Yes or No) Not applicable Page 5 of 32

6 Each question and compliance has to be looked at individually and scored according to the severity of the deficiency, the number of deficiencies and the associated risks. Detailed compliance requirements are noted in this AuditGuidelines document, but some general statements are described below. These statements are superseded by the compliance criteria and users should be aware that some questions do not follow the general statements below e.g. automatic failure questions. Compliance for questions in Module 1, Module 2 GMP option and Module 3 Answer Total compliance Minor deficiency Major deficiency Noncompliance Not applicable Criteria used To meet the question and/or compliance criteria in full. To have minor deficiencies against the question and/or compliance criteria. To have single or isolated non-severe deficiencies (usually up to three) against the question and/or compliance criteria. To have covered most of the question compliance criteria, but not all. To have major deficiencies against the question and/or compliance criteria. To have numerous non-severe deficiencies (usually more than three) against the question and/or compliance criteria. To have single or isolated severe deficiencies against the question and/or compliance criteria. To have covered some of the question compliance criteria, but not most of it. To have not met the question and/or compliance criteria requirements at all. Having systematic deficiencies against the question and/or compliance criteria (severe or non-severe issues). The requirement described in the question is not applicable for the operation being audited. Justification should be provided in the auditor s comments. Be aware that there are some questions that do not allow the answer Not applicable. Page 6 of 32

7 For questions in Module 2 GAP option, if deficiencies for the question and/or the applicable expectations for that question are found, assign the answer to each question as described below in the general statement of the table. These statements are superseded by the criteria described in the question s expectations and applicants and users should be aware that some questions do not follow these general statements e.g. automatic failure questions Compliance for questions in Module 2 GAP option Answer Total compliance (can be Yes or No, depending on the question) Non-compliance (can be Yes or No, depending on the question) Criteria used To meet the question and/or compliance criteria in full. This is when the answer Yes or No is the same as the earning answer. The question or compliance criteria has not been fully met. This is when the answer Yes or No is NOT the same as the earning answer. Not applicable The requirement described in the question is not applicable for the operation being audited. Justification should be provided in the auditor s comments. Be aware that there are some questions that do not allow the answer Not applicable. Automatic Failure There are some questions that if down scored will lead to an automatic failure and an overall score of % for the corresponding Module. These questions have been defined as automatic failure because they represent high risk situations where any deficiency on them represents a sign of an immediate potential food safety risk. These questions are identified with the phrase: ANY DOWN SCORE IN THIS QUESTION RESULTS IN AN AUTOMATIC FAILURE. Please also note, that under special circumstances and upon finding serious food safety risks a failed audit can be attributed. Examples of special circumstance include detection of illegal activities such as deliberate mislabeling, discovery of falsified records. The auditee should be immediately informed of the automatic failure by the auditor during the audit. The auditee has the option to have the auditor continue and complete the audit or to have the audit halt at that point (all charges will apply). Audit Termination Once an audit has been started, should the auditee wish to stop the audit for any reason other than an automatic failure (see text above) the auditor will complete the report for as many questions as they were able to verify. PrimusGFS audits cannot be converted into a pre-assessment audit once the audit has been started. If an audit is terminated early then questions that the auditor was unable to verify, will be marked as non-compliance and receive a score of zero. For questions unable to be verified the auditor will indicate the audit was terminated at the request of the auditee before the auditor could verify whether or not the audit conformed to the compliance criteria of the question. A report will be created on the database and issued and all charges will apply. Page 7 of 32

8 Documentation Requirements New Auditees/First Time Facility Auditees In operation for more than three consecutive months auditee should have at least three months of documentation available for review. If the auditee has less than three months of most of their documentation available for review a pre-assessment audit is strongly advised. If the auditee has less than three months of most of their documentation available for review and decides to have a regular audit, they should be aware that they cannot receive full conformance for paperwork questions relating to monitoring and that the down score will be based on the amount of paperwork available. Short season operation, in operation for less than three consecutive months - auditee should have at least three months of documentation available for review (this may include last season s documentation). Where an operation does not have three months of records available (e.g. one month of operation per year) auditee should have at least the previous season s records available for review. If the auditee has less than three months of most of their documentation available for review and decides to have a regular audit, they should be aware that they may not receive full conformance for paperwork questions relating to monitoring and that the down score will be based on amount of paperwork available. Existing Auditees In operation for more than three consecutive months auditee should have at least three months of documentation and documentation at least since the last audit. Short season operation, in operation for less than three consecutive months auditee should have at least three months of documentation and documentation at least since the last audit (which includes the last season). Where an operation does not have three months of records available (e.g. 1 month of operation per year) auditee should have at least the previous season s records available for review. New Auditee Existing Auditee Operates <three months/year Three months of records (may include last season s records) Records at least since last audit (or longer) to meet minimum requirement of three consecutive months of records Operates >three months/year Three months of records (may include last season s records) Records since last audit Page 8 of 32

9 Glossary Agricultural Inputs Materials used in the production of crops including seeds, transplants, rootstock, cuttings, fertilizers, crop protection products, adjuvants, growth promoters, predator additions, irrigation water and any other material inputs to the growing process. Cooling Cold Storage This type of facility is where they are not only receiving and storing finished goods but performing some kind of pre-cooling and/or cooling activities. In this type of facility, no packing or processing activities are being performed, if so, a different type of facility operation shall be used. A Cooling Cold Storage facility covers the activities involved in the Storage & Distribution Center type. Facility operation A handling operation carried out in one or several buildings where product is being handled. The type of Facility operation can be classified as: Storage & Distribution Center, Cooling Cold Storage, Packinghouse or Processing. The following image describes the scope of each one of the facility types described in this certification scheme: Storage & Distribution Center Cooling/ Cold Storage Packinghouse Processing Figure 1. Facility types relationship and coverage Field operation A growing operation carried out in an open or in a covered area for the production of fresh produce for human consumption. The type of Field operation can be classified as: Ranch or Greenhouse, they can both include or not include another type of operation named Harvesting. The following image describes the scope of each one of the field types described in this certification scheme: Ranch Harvesting Greenhouse Figure 2. Field types relationship and coverage Page 9 of 32

10 Greenhouse A greenhouse is defined as a building constructed of glass or plastic, for the cultivation of plants under controlled environmental conditions. Product grown under this type of operation is marketed as Greenhouse grown. Harvest Crew A "harvest crew" is defined as a crew of harvest personnel under common management. Packinghouse This type of facility is where whole commodities are sorted and/or sized, may be minimally trimmed (not altered in form), washed or not washed, possible post-harvest fungicide treatments applied (e.g. wax treatments) and packed for commercial distribution and use by consumer or retail establishment. In this type of facility, no processing activities are being performed, if so, a different type of facility operation shall be used. A Packinghouse facility covers the activities involved in the Storage & Distribution Center and Cooling/Cold Storage facilities. Processing This type of facility is where whole commodities are minimally processed and altered in form by peeling, slicing, chopping, shredding, coring, or trimming, with or without washing, prior to being packaged for use by the consumer or a retail establishment (e.g., pre-cut, packaged, ready-to-eat salad mixes). In this type of facility, processing activities are being performed, if not, a different type of facility operation shall be used. A Processing facility covers the activities involved in the Storage & Distribution Center, Cooling/Cold Storage and Packinghouse facilities. Ranch A "ranch" is defined as a parcel of ground (not necessarily a "lot" for production purposes) with the following characteristics: common management, common water supply and contiguous grounds. For the purpose of farm or ranch audits, manual development or self-audits, a ranch or farm is defined as contiguous ground that is under common management. Storage & Distribution Center This type of facility is where they are only receiving and storing finished goods for further shipment e.g. regional distribution warehouses. In this type of facility, no cooling, packing or processing activities are being performed, if so, a different type of facility operation shall be used. Page 1 of 32

11 Module 1 Management System 1.1.1: Is there a Food Safety Manual or other documented food safety management system covering the scope of business included in this audit and procedures/instructions for all food safety processes? Total compliance (5 ): The Food Safety Manual is appropriate for the scope to be covered by the audit and include documented policies, standards, procedures* etc., and/or specific reference to them. The Food Safety Manual should be available to relevant workers. A food safety plan may also be used to cover the requirements of this question, as long as it also covers the noted below. The Manual should include or reference (actual documents may be located in another manual): 1. The company s food safety policy 2. Organizational chart 3. List of products 4. Pre-requisite programs 5. Product descriptions, process flows, hazard analysis, etc., and where relevant, details of critical control including monitoring and corrective action details. 6. Forms used in implementation of food safety management system (actual records may be located elsewhere e.g. another manual). 7. Verification activities such as internal audits, testing, complaints analysis and validation work where application. * Standard operating procedures (SOPs) are scored in and Minor deficiency (3 ) if: If one of the above elements is missing. If two or more elements are missing. Non-compliance ( ) if: A written Food Safety Manual (or equivalent) is not available for review : Is there a documented food safety policy detailing the company's commitment to food safety? Total compliance (5 ): There should be a dated, signed (by senior management) documented food safety policy statement reflecting the organization s ongoing commitment to providing a safe product. The policy should include statements and objectives of the company s commitment to food safety, following food safety laws, adhering to industry food safety best practices and a process of continual improvement. Everyone in the company should understand the food safety policy and be aware of their role in ensuring that it is met (e.g. by training, communicating organizational chart, etc.). The policy should be posted in a public area. The policy may take the form of a mission statement provided it meets the requirements detailed above. Minor deficiency (3 ) if: Policy lacks an element listed above. Single/isolated instance(s) of errors or omissions in the policy. Policy lacks more than one element noted above. Numerous instances of errors or omissions in the policy. Page 11 of 32

12 Failure to communicate the policy to employees. Policy is not posted in a public place. Non-compliance ( ) if: No policy exists. Systematic failures to keep records and or corrective actions : Is there an organizational chart of all employees who have food safety related activities? Total compliance (3 ): There should be an organizational chart showing positions and reporting structure of employees whose activities affect food safety within the company. Chart is dated to indicate it is correct and current. Job functions and responsibilities related to food safety should also be documented. Alternates should be indicated or reference document indicating this information. For very small companies, an individual employee may cover many jobs. Document should be dated and reflect current status. Minor deficiency (2 ) if: Single/isolated instance(s) of errors or omissions on the organizational structure chart or responsibilities. A document is not dated. Numerous instances of errors or omissions on the organizational structure chart or responsibilities. More than one document is not dated. Non-compliance ( ) if: Systematic errors on the organizational structure chart or responsibilities. No process organizational structure chart or responsibilities : Is there a food safety committee and are there logs of food safety meetings with topics covered and attendees? Total compliance (5 ): There should be an active food safety committee, responsible for the strategic maintenance and development of the operations food safety plan. If an operation has a HACCP plan, the HACCP team may also look after the food safety issues. The company should be keeping logs and minutes/notes of meetings addressing food safety topics. These meetings might be dedicated to food safety or may be part of another regular meeting, e.g. a production meeting, HACCP meeting, etc. These records should demonstrate Senior Management involvement in the Food Safety program for example show management attendance, minutes copied to management and, missing members are indicated on records. Meetings should occur at least quarterly during the season of operation. Where the operation has less than three months of records available there should be at least one meeting available for review score minor deficiency; if no records score non-compliance. Minor deficiency (3 ) if: Single/isolated instance(s) of errors and omissions in the meeting logs e.g. not noting who was attending the meeting (including Senior Management). Only three meeting have occurred in the last 12 months (for an all year round operation) Numerous instances of errors and omissions in the meeting logs e.g. not noting who was attending the meeting (including Senior Management). Two or less meetings have occurred in the last 12 months (for an all year round operation) Non-compliance ( ) if: Food safety committee has not been created. Page 12 of 32

13 The company does not have logs of food safety meetings : Is there documented management verification of the entire food safety management system at least every 12 months? Total compliance (5 ): There is documented verification of the entire food safety management system at planned intervals (minimum 12 month intervals) and reviewed by senior management to ensure its continuing suitability, adequacy and effectiveness. The review should include an analysis of the effectiveness of key food safety programs and that they are implemented correctly. Based on effectiveness, changes to the system are documented. The review should show if the system is being implemented correctly and determine the need for changes to the system. Where changes are required, this should be indicated on the verification paperwork along with corrective action details. If applicable, HACCP verification should be performed as well. Both activities can be performed together or separately. Records of all verifications activities, reasons for amending documents, validations and changes should be available for review. Internal Audits External Audits (2 nd Party and 3 rd Party) Analysis of feedback/complaints and recalls (where applicable) Review and updates to operation s objectives Review of organizational chart Updates, changes or new SOPs HACCP verification Other food safety managements system related activities Minor deficiency (3 ) if: Single/isolated instance(s) of errors or omissions in the verification activities. Single/isolated instances of key programs not evaluated for effectiveness It has been more than 12 months since management verification but less than 18 months. Numerous instances of errors or omissions in the verification activities. Numerous key programs such as pest control, supplier control or sanitation operating procedures not evaluated for effectiveness It has been more than 18 months since management verification (but less than 24 months). No proof of senior management review. Non-compliance ( ) if: Systematic errors or omissions in the verification activities. Most key food safety programs not evaluated for effectiveness It has been more than 24 months since management verification : Is there a documented analysis detailing resources required to implement and improve the food safety management system processes with documented commitment from senior management to provide these resources? Total compliance (5 ): There should be evidence that management is aware of the requirements of the food safety program including (as a minimum) an analysis of the resources required and provided for: Personnel training requirements Employee needs (to cover sickness, vacations, etc.). Equipment and services (e.g. computers, testing equipment, etc.). Ensuring effective employee communication (e.g. training needs, etc). Meeting customer requirements/specifications. Minor deficiency (3 ) if: Page 13 of 32

14 If one of the above elements is missing. If two or more elements are missing. Non-compliance ( ) if: Documented evidence is not available for review. Control of Documents and Records 1.2.1: Is there a written document control procedure describing how documents will be maintained, updated and replaced? Total conformance (3 ): There should be a record of all documents used, when they were issued and updated with the current revision status to help avoid using obsolete documents. Documents examples include pre-requisite programs, SSOPs, SOPs, forms (record templates), other work instructions, raw material and finished product specifications, etc. The document control procedure should specify: Who is responsible for document control (i.e. making sure documents are updated and securely stored). How documents are updated and amendments are approved (e.g. how paper versions are approved, computer records password protected, etc.). How changes are identified and recorded (e.g. date, issue number, different colored text or font, change history document etc.). How the inadvertent use of obsolete documents is prevented. Minor deficiency (2 ) if: Single/isolated instance(s) of errors or omissions in the procedure. Numerous instances of errors or omissions in the procedure. Non-conformance ( ) if: There is no written procedure 1.2.2: Are all records stored for a minimum period of 12 months or for at least the shelf life of product if greater than a year? Total compliance (5 ): Records are retained for auditing purposes, in case there are legal issues, customer queries, etc. All monitoring and process control records should be held for a minimum of one year regardless of the production item s shelf life. For Good Agricultural Practices (GAP) growing area records include all cultivation records; for GAP harvest crew records include harvesting related records. Any records required by law to be kept longer than one year should be kept the legally mandated period. Any records pertaining to long life product should be kept at least for the duration of the shelf life of the product. Ideally (not part of the audit scoring) some records that might go to prove the long term food safety performance of the operation should be retained for as long as possible for example internal and third party audit records and corrective actions.. Minor deficiency (3 ) if: Single/isolated instance(s) of process control records not being retained for the required length of time (one year unless legally longer storage is required or the product has a longer shelf life than 12 months). Page 14 of 32

15 Numerous instances of process control records not being retained for the required length of time (one year unless legally longer storage is required or the product has a longer shelf life than 12 months). Non-compliance ( ) if: Process control records are kept less than 12 months. Process control records are kept less than the required time mandated by law for a particular product. Process control records are kept for less than the shelf life of the product : Are food safety related documents and records stored and handled in a secure manner? Total compliance (3 ): Food safety documentation e.g. SOP s, records, etc. including procedures, policies, programs, training records, testing results, monitoring records and tracebacks should be stored in a secure manner that deters theft and prevents tampering, when not in use. For example, the system might be the locking up of all manuals and recording logs at night in the QA Lab., when the operation is not running. There might also be rules for storing records in a secure archive room. Where computer systems are used to store SOP s records, etc., there should also be security measures including access control (password protection). The computerized records and documents should also be backed-up in some way e.g. stored in two locations, so that if one location breakdowns or is damaged, the data is not lost. Paper files should be written in ink, not pencil and if changes are made to records after initial entry, changes should be clearly legible and tracked no use of correction fluid. Electronic records should show editing history. Minor deficiency (2 ) if: Single/isolated instance(s) of hardcopy documents and records not being stored securely. Single/isolated instance(s) of computerized documents and records not being stored securely. Single/isolated instance(s) of hardcopyand/or computerized records not being updated properly. Numerous instances of hardcopy documents and records not being stored securely. Numerous instances of computerized documents and records not being stored securely. Computerized documents and records are not being backed-up. Numerous instance(s) of hardcopy and/or computerized records not being updated properly. Non-conformance ( ) if: Hardcopy documents and records are not stored securely. Computerized documents and records are not being stored securely. No control over editing of hardcopy and/or computerized records : Are the records maintained in an organized and retrievable manner? Total compliance (3 ): All food safety records should be maintained in a designated area where they can be retrieved readily. These records should be well organized. This will aid in the detection of issues, trends and retrievable of information. Binders or file system is acceptable. System might be by date or together in a single file for a particular record. It may be that data is kept on computer. Minor deficiency (2 ) if: Single/isolated instance(s) of records not being organized and easy to retrieve. Numerous instances of records not being organized and easy to retrieve. Page 15 of 32

16 Non-conformance ( ) if: No organization of records. Many missing records. Page 16 of 32

17 Procedures and Corrective Actions 1.3.1: Are there documented instructions for the creation of Standard Operating Procedures? Total compliance (5 ): There should be written document that describes how to write Standard Operating Procedures (SOPs) for food safety activities and good manufacturing practices that when followed, help prevent food safety hazards from occurring. The SOP's should detail: what is to be done, how it is done, how often, by whom, what recordings are required and any corrective action procedures to perform when there are any deficiencies. These SOPs can be used for training and as reference tools. SOPs should follow the organizations document control systems, especially proper version management (see Control of Documents and Records). Minor deficiency (3 ) if: Single/isolated instance(s) of errors and omissions within the document. Numerous instances of errors and omissions within the document. Non-conformance ( ) if: A document describing how to write standard operating procedures has not been created : Are the written procedures available to relevant users and is a master copy maintained in a central file? Total conformance (5 ): The written procedures (SOPs) should be available to the users and any other interested parties. A master copy of all SOP's and associated recording forms should be collated in order to create (an) SOP Manual(s), sometimes called a Quality Manual. SOP s should be used by the relevant employees, e.g. QA employees, production, sanitation, etc. SOP s can be used for training and for reference. The number of copies of SOP s depends on the size of the company and the types of processes involved. In the event of electronic SOP s, access should be allowed to all relevant employees, however there should be controls in place to prevent unauthorized editing. Ideally (not part of the audit scoring) a manual with current copies of required recording forms (often referred to in SOP s) is available to users and a master copy maintained in a central file. Minor deficiency (3 ) if: Single/isolated instance(s) of SOP s not being made available to relevant employees. Single/isolated instance(s) of SOP s and recording forms being omitted from the Master SOP file (SOP Manual). Numerous instances of some SOP s not being made available to relevant employees. Numerous instances of SOP s and recording forms being omitted from the Master SOP file (SOP Manual). Non-conformance ( ) if: SOP s are not accessible to relevant employees. Page 17 of 32

18 A master file (SOP Manual) containing the SOP s and recording forms that are being used, has not been created : Is there a corrective action procedure that describes the requirements for handling deficiencies affecting food safety and prevention of future occurrences? Total compliance (5 ): Written procedures include the corrective actions to be taken in case of any deficiency affecting food safety is identified. Records of the corrective action activities and their follow-up should be kept on file (omission of corrective actions is scored under specific questions in Module 2 of the audit). Corrective action procedure should include: the review of the non-conformance the determination of the causes the establishment of an action plan address such non-conformances and prevent future occurrences (preventive action plan) the implementation of corrective actions and preventive actions the follow-up validation to ensure actions taken have solved the problem Auditees may consider the option of using root cause analysis method when trying to determine the cause of a non-conformance or trend of non-conformances. Minor deficiency (3 ) if: Single instance of an error or omission in the information within the corrective action procedure. Single instance of corrective action procedure missing a key element from list above. More than one instance of errors or omissions in the information within the corrective action procedure. More than one instance of corrective action procedure missing a key element from list above. Non-compliance ( ) if: Numerous errors or omissions in the corrective action procedure. Corrective action procedures have not been developed : Is there a daily incidents report, sometimes called a Notice(s) of Unusual Occurrence and Corrective Actions Log (NUOCA)? Total conformance (5 ): The company has a log or report for recording infrequent and/or unusual events such as deviations, incidents, process failures, unusual occurrences, etc., For example, foreign objects, chemical spills, rejected packaging, downtime, etc., that are not recorded on other logs. These should have corrective action records where relevant. This log, often called a NUOCA log (Notice(s) of Unusual Occurrence and Corrective Action Log), helps avoid creating multiple logs for events that do not occur very often. If product testing is performed (microbiological, heavy metal, pesticides, dioxins, aflatoxins, etc.), and there are out of specification results, there should be a NUOCA. Useful to consider recording issues that might or might not temporarily affect production e.g. loss of power, blocked drains, weather damage, earthquakes, etc., since at a later date, if there are product issues, these events might be of significance. Minor Deficiency (3 ) if: Single/isolated instance(s) of omissions or incorrect data in the records. Major Deficiency (1 point) Page 18 of 32

19 Numerous instances of omissions or incorrect data in the records. Non-conformance ( ) No records. Failure to maintain records. Internal and External Inspections 1.4.1: Is there a documented program for internal audits to be performed at the operations, covering all processes impacting food safety and related documents and records? Total compliance (3 ): Self-auditing (self-diagnostics) is a key part of an operation s food safety program. A program for internal audits should be created for each operation (field or facility) in order to proactively ensure safe food production. The internal audits should cover the inspection of sites, the practices in place, the related documents required and the records generated. The program should include the checklist used for the internal audits, the frequency of the internal audits and identification of the person(s) responsible for conducting the internal audits. Program should include the verification of the practices and the related documents and any corrective actions taken. Self-audits should be fully documented even if no changes are located. If issues are found, there should be detailed corrective action records. Audit records should include the date, personnel involved, areas that were checked, findings and corrective actions (where necessary).recording systems for food safety related topics should be audited on a routine basis to ensure that they are being completed properly e.g. using the correct log, correct frequencies, recording results correctly, recording corrective actions, etc. This includes the food safety management system. Inspection should include: Inspection frequency depends on type and size of operation but as a minimum: Field (GAP option): at least a pre-season assessment and a full GAP self-assessment during harvest season should be on file covering growing and harvesting operations. More frequent inspections may be necessary depending on the type of crop, field location and associated risk pressures.these factors will also affect the need for pre-harvest inspections. Fields, storage, harvesting and associated paperwork should be included. Facility (GMP option): Processing plants should have at least a monthly frequency. Packinghouses, coolers and storage operation ideally have a monthly frequency, but at least a quarterly frequency. Entire facility (inside and out) should be included. HACCP: self-audits of the HACCP program should have been done at least once within last 12 months to ensure that the process flow, hazard analysis and HACCP chart reflect reality and ensure that the program has captured any changes to the process. Whenever changes are made to the program i.e. new equipment added to the facility, new critical control added to the plan, new limits added, new packaging is required, etc., then the plan needs to be re-evaluated by a self-audit to make sure it is working properly (3.2.11). HACCP program reviews should also take into account the latest guidelines, legal changes, issues arising from other audits and any other information gained about the production process. Self-audits help verify the effectiveness of the HACCP program, identify deficiencies and help improve the program. Who conducted the inspection Documented findings Corrective actions (including completion date) Minor Deficiency (2 ) if: Single/isolated instance(s) of follow up/corrective actions not noted. Single/isolated instance(s) of incomplete or missing records. Single/isolated instance(s) of areas/issues missing on the inspection program. Page 19 of 32

20 Single instance of self-audit not occurring at least at the minimum frequency. Major Deficiency (1 point) if: Numerous instances of follow up/corrective actions not noted. Numerous instances of incomplete or missing records. Inspection frequency is not adequate relative to the type of business and the number of issues that require monitoring. Changes to the HACCP plan have been made but the self-audit had not been conducted. Numerous instances of areas/issues missing on the inspection program. More than one instance of a self-audit not occurring at least at the minimum frequency. Non-conformance ( ) if: Systematic failure to record self-audits properly.. Self-audits are not being conducted. Numerous instances of self-audits not being done at least at the minimum frequency : Are there written procedures for handling regulatory inspections? Total compliance (3 ): Written procedures for handling regulatory inspections are available for employees to follow when regulatory agencies inspect the operation. Regulatory agencies could be FDA, USDA, Health Department, State enforcement organizations, etc. The procedures should include at a minimum rules for always accompanying inspections, rules on taking samples and taking photographs. This policy should be communicated to key personnel including the receptionists, field staff and crew supervisors. Inspection policies must not contravene bio-terrorism laws and restrict access to documents that have been covered by these laws. Minor deficiency (2 ) if: If one of the above elements of the policy is missing. If the receptionist(s) has/have not been briefed properly. If two or more elements of the policy are missing. Non-compliance ( ) if: A written procedure for handling regulatory inspections is not available for review : Are there records of regulatory inspections and/or contracted inspections, company responses and corrective actions, if any? Total compliance (5 ): Reports of previous inspections are on file and any deficiencies noted have been responded to (date of response, action taken, and signature). Inspections include regulatory (e.g. Federal and State) and third party audits. Auditors are requested not to look at second party audits, since sometimes they include confidential quality and product development information. This question is not applicable if there have been no regulatory or third party inspections in the past year. Evidence of corrective actions (and their follow-up) is important, since there are legal implications if a company was warned of an issue and cannot prove that it has taken corrective actions and later has a serious incident which could have been prevented. Minor Deficiency (3 ) if: Single/isolated instance(s) of corrective actions not being recorded. A single audit inspection report is missing in the last year. Page 2 of 32

21 Major Deficiency (1 point) if: Numerous instances of corrective actions not being recorded. More than one audit inspection report is missing in the last year. Non-compliance ( ) if: There are no records of previous inspections and corrective actions taken although there have been more than two inspections in the last year. If a previous inspection indicated an observation of contaminated ingredient, product or food contact packaging and there are no documented corrective actions : Are there documented calibration procedures for measuring and monitoring devices used in the operations that are related to the safety of the product? Total compliance (1 ): There are documented policies and/or procedures for the calibration for measuring and monitoring devices used in the operation. Regular calibration ensures correct and accurate operation. For the farm (GAP option), this covers items such as fertilizer and crop protection application equipment, crop protection measuring equipment (e.g. scales), ORP and ph meters, and other equipment related to the safety of the product. For the facility (GMP option) this includes equipment used for measuring and monitoring processes (hand held and automated) related to food safety e.g. thermometers, metal detectors, ORP meters, flow meters and ph meters. Equipment is calibrated regularly to ensure correct and accurate operation. Calibration procedures should describe the frequency of testing, the testing method and the acceptable range of variation. Procedures should require that all test solutions/strips are within date code, appropriate for the concentrations used and stored correctly (especially light and temperature sensitive materials). Corrective actions should be detailed when applicable. Legal requirements, manufacturer recommendations, best practice and experience of equipment drift help to determine the frequency. Both internal (where the company checks the equipment for themselves) and external (where equipment is sent away or an outside specialist company comes on site and checks the equipment in situ) calibrations should be documented and on file. Proof of calibration includes records, invoices and on machines labels. Hand application of fertilizers is not recommended as it is difficult to assure an even distribution of fertilizer or crop protection product. If done however, it is important to choose a pace that is easy to maintain and duplicate Minor Deficiency (7 ) if: Single/isolated instance(s) of omissions in the procedure(s). Single/isolated instance(s) of omissions or incorrect data in the records. Single/isolated instance(s) of piece/set of equipment omitted from the scheme. Major Deficiency (3 ) if: Numerous instances of omissions in the procedure(s). Numerous instances of omissions or incorrect data in the records. Numerous instances of pieces/sets of equipment omitted from the scheme. Non compliance ( ) if: No procedure No records Failure to maintain records. Page 21 of 32

22 Rejection and Release of Product 1.5.1: Is there a written procedure for handling on hold or rejected products? Total compliance (5 ): A documented procedure exists that explains how products (includes ingredients and packaging) should be handled, that has either been rejected or placed on hold. For harvested product in the field and the facility, the procedure should include details on how the affected product lot(s) is/are separated from other lots in terms of tagging systems e.g. date showing when the product was placed on hold/rejected, the reason for being on hold/rejected and the name of the person who put the product on hold (details may be recorded electronically as long as products are clearly tagged) and any other physical separation to ensure that affected product is not commingled with other goods in such a way that their disposition is not clear. For the pre-harvest materials, procedures should include how the affected product is indicated in the field e.g. cordoned off, any buffer zones used, how these details are recorded, etc.). Procedure requires authorized personnel should sign (with date and time) a release for any item placed on hold or rejected, detailing actions taken e.g. disposition, re-work, food bank, tilled back into the ground, etc. Minor deficiency (3 ) if: Single part of the procedure is omitted. Single/isolated instance(s) of the procedure not being applied in the field, production and/or storage areas. Procedure missing more than one part, but SOP exists. Numerous instances of the procedure not being applied in the field, production and/or storage areas. Non-compliance ( ) if: No procedure. Procedure created bares no resemblance to what is being applied in the field, production and/or storage areas : Are there records of the handling of on hold or rejected products kept on file? Total compliance (5 ): Records of items placed on hold or rejected (e.g. an on hold/disposition log) should be available for review. Records should show date when the product was placed on hold/rejected, the reason for being on hold/rejected, the name of the person who put the product on hold and any other actions taken to ensure that affected product is not commingled with other goods in such a way that their disposition is not clear. Authorized personnel should sign (with date and time) a release for any item placed on hold or rejected, detailing actions taken e.g. disposition, re-work, food bank, tilled back into the ground, etc. Disposition records for products placed on hold or rejected should be maintained and available for review where applicable. Where required by law, certificates of destruction should be kept for review. Minor deficiency (3 ) if: Single/isolated instance(s) of omissions or incorrect data in the records. Numerous instances of omissions or incorrect data in the records. Page 22 of 32

23 Non-conformance ( ) if: There is no record of on hold or rejected materials : Is there a documented product release procedure available? Total compliance (5 ): Product release procedures assure that a lot is only released for shipment (sale) when lot meets agreed standards such as order requirements (e.g. specification) and/or meets agreed testing requirements (e.g. results confirmed negative or within limits results from testing, etc.). Products should not be released for shipment without assuring that all food safety evaluations have been completed. Designated personnel are responsible for signing off. Sign off may be part of harvest record, bill of lading, etc. Procedures should be properly documented, implemented and pertinent records retained. Procedures should take into account any specific customer requirements, for example, testing requirements. Minor deficiency (3 ) if: Single part of the procedure is omitted. Single/isolated instance(s) of omissions or incorrect data in the records. Single/isolated instance(s) of the procedure not being applied in the field, production and/or storage areas. Procedure missing more than one part, but SOP exists. Numerous instances of omissions or incorrect data in the records. Numerous instances of the procedure not being applied in the field, production and/or storage areas. Non-compliance ( ) if: No procedure. No records. Procedure created bares no resemblance to what is being applied in the field, production and/or storage areas : Are there records of product releases kept on file? Total compliance (5 ): Records showing product releases should be available for review. Authorized personnel should sign a release for product. Sign off may be part of harvest record, bill of lading, etc. Minor deficiency (3 ) if: Single/isolated instance(s) of omissions or incorrect data in the records. Numerous instances of omissions or incorrect data in the records. Non-conformance ( ) if: There is no record of on hold or rejected materials : Is there a documented system for dealing with customer complaints and buyer food safety complaints and are those on file, along with company responses, including corrective actions? Total compliance (1 ): There is a documented policy/procedure detailing how to handle food safety and food quality complaints and feedback. Food quality issues are relevant if they have the Page 23 of 32