The Food Producer’s Guide to 3rd Party Audits

Part 1: Understanding Third Party Audits

What Is a third party audit?

A third party audit is when a food business hires an independent auditing firm to complete a food safety and quality assessment of their operations. While there are many different types of 3rd party audits --- such as a financial audit by an accounting firm --- this guide refers to a food safety audit.

“Third party” means the audit performed by an independent firm. While many food businesses conduct internal audits of their own operations, enlisting an outside firm maximizes the likelihood of an unbiased assessment.

When is a third party audit required?

A third party audits is typically required when the purchaser of a food product (or packaging) wants to confirm the quality and safety of the product they are buying. This ongoing process is known as “supplier verification”.

Purchasers (e.g. supermarkets and food retailers) often verify their suppliers by requiring that they be audited to a reputable set of food safety standards. This is a simple arrangement: the purchaser specifies the type of audit required and the food processor engages the third party auditor and completes the audit on their own timeframe. Then, the food processor provides the audit report or certificate to the purchaser, who reviews it and keeps it on file.

It’s worth noting that there are many different forms of supplier verification aside from a third party audit result. However, third party audits are a favored method of supplier verification among large retailers because they are trustworthy and require no additional work beyond reviewing the audit result.

For more details, see “Decide if your business requires a third party audit”

How do third party audits work?

*This section is very important*

There are several different parties that come together and allow third party audits to work. It is absolutely critical to understand how these organizations work together so you can understand what type of audit your business needs to complete.

GFSI

The first thing to understand is GFSI or, the Global Food Safety Initiative. They are an international organization which created a single set of broad food safety standards. Their goal was to create a “benchmark” that specific certification schemes could tie themselves to.

It’s easiest to think of GFSI like a set of broad recommendations made to the food industry.  GFSI doesn’t conduct audits or certify food businesses --- they only provide the overarching food safety standards around which individual certifications are designed. These certification schemes are considered GFSI-benchmarked and there are a handful of GFSI-benchmarked certifications that a food business can choose to pursue.

Certification Scheme

A certification scheme is a private organization that has developed their own set of standards and auditing framework. Businesses can apply for that certification, pay a fee, and submit the requirements . Upon approval, then the certification scheme sends the food business a certificate showing that they are aligned with the scheme standards. Common certification schemes which are unrelated to food safety may include “Certified Kosher” “Certified Organic”

Popular food safety certification schemes include SQF, BRC, and FSSC 22000. Each of these schemes has their own specific set of standards that a food business can align their practices with. And while they are all unique, they are GFSI-benchmarked. This is important because many food retailers require that their suppliers complete a “GFSI-benchmarked audit”, or a “GFSI audit” for short.

There are also many certification schemes that are not GFSI-benchmarked. This isn’t a bad thing --- it means those certification schemes can choose an alternative emphasis, such as alignment with HACCP or GMPs.

But here’s the catch --- the certification schemes don’t typically conduct the audits themselves. Instead, they outsource this to auditing firms, also known as “certification bodies.”).

Auditing Firms (Certification Bodies)

The auditing firms are private business that actually conduct the audit. This is the company that the food processor schedules the audit with, pays, and interacts with during the audit itself.

There are thousands of auditing firms which a food business can hire to conduct a food safety audit. Most large auditing firms are certified to audit across multiple certification schemes (e.g. SQF and BRC), which allows them to appeal to a wider range of clients.

What actually happens during a third party audit?

Here’s what typically occurs during a third party audit ---

1. The auditor meets with the site management so they can review the expectations for the audit.

2. The auditor may conduct a “desk audit” which includes a review of the company’s food safety documentation and records. These documents show how the company operates and will help the auditor understand what he/she is seeing during the facility audit.
   

3. The auditor conducts a “facility audit” where they walk around the site and observe operations. Here, the auditor is looking for a few things. First, they want to see that the business is doing what they described in their food safety documentation. Second, the auditor is looking for conditions that either support or violate the standards that the facility is being audited against. The auditor may ask questions to the site management as well as employees working throughout the space.

4. Finally, the auditor scores the audit and presents these findings to the site management. Even when the site achieves a passing result, they may still have to prove that they addressed the deficiencies identified in the audit before they receive a certificate for passing.

Third Party Audit vs. 3rd Party Certification

A 3rd party audit is a snapshot of food safety and quality conditions at a food business. The value of a passing a single audit result diminishes as more time passes since the audit was conducted. After 12 months, the audit result has little value.

For this reason, a food business may choose to pursue to pursue a 3rd party certification. This entails an ongoing commitment to maintaining the standards of that scheme. After passing an initial audit, paying certification fees, and agreeing to host future, unannounced audits, the company is given certificate of good standing.

This certificate is the ultimate gold-star when it comes to demonstrating a food processor’s commitment to food safety. Practically, this translates to a smoother onboarding experience when selling to large scale buyers (such as a mainstream supermarket chains or an airline). For large scale food businesses, maintaining 3rd party certification saves them considerable time and resources.

What kind of business typically requires a third party audit?

Almost all businesses along the food supply chain will require a third party audit when they achieve a large enough scale. This would include the following types of businesses

• Food processors / manufacturers

• Raw ingredient manufacturers

• Packaging manufacturers

• Carriers (food transporters)

• Food Distributors / Warehouses

• Fresh cut facilities

• Farms

Typically, audit requests move upstream along the supply chain. In other words,  businesses require their suppliers to present an audit certificate.

Does a restaurant require a third party audit?

Food service establishments (e.g. restaurants) don’t typically have a reason to complete a third party audit. This is because third party audits are usually required by the wholesale purchaser of a food product --- and restaurant diners don’t typically make this type of demand.  

A notable exception would be large restaurant or fast food chains. In this case, the management may enlist an external auditing firm to audit all of their locations because it is easier than having an internal employee perform this job. However, the results would be for internal use only.

How is a third party audit different than a government inspection?

It’s easiest to understand the difference between a third party audit and a government inspection by considering what would happen if a poor result is found.

In a government agency inspection (such as the FDA or state health dept.) the agency can take immediate action if the food business performs poorly in the inspection. These actions could include suspending that business’s operating permit, quarantining product, or initiating a recall. In a more common scenario, the agency would list the violations that need to be addressed --- these would be provided in the form on an inspection report --- and then the business would need to make those changes before the agency returns.

It’s very unlikely that a poor result from a  third party audit would require a processor to halt production altogether. The reason is that, unlike the government, an independent audit firm cannot force their client to stop operations.

At worst, a third party auditor could revoke the certificate associated with the scheme that they are auditing towards (e.g. SQF). If the third party audit is being conducted by retailer as part of their supplier approval process, then that buyer may refuse to make additional purchases until certain changes have been made.