Non-conformities in GFSI recognized standards

GFSI recognized standards

In order to have clarity about non-conformities and their weighting during an audit, this article summarizes how BRC, IFS and FSSC22000 deal with non-conformities. As the GFSI guidance guides these standards, the weighting of a non-conformance will normally be the same.

In the Netherlands there is currently a trend for auditors to issue a critical non-conformity for FSSC22000 when a legal requirement is not met. This method of assessment is not in line with BRC and IFS and also not in line with the Dutch Food Safety Authority. As stated in the FSSC standard:

A critical nonconformity is issued when a direct food safety impact without appropriate action by the organization is observed during the audit or when legality and/or certification integrity are at stake.

Legality -the quality or state of being in accordance with the law

At stake means at risk;

• “people’s lives could be at stake”
• “If something that is valuable is at stake, it is in a situation where it might be lost”
• “Thousands of lives will be at stake if emergency aid does not arrive in the city soon”

Some auditors really think that a legal incompliance is directly a critical.
To be at stake is not the same as an incompliance.

BRC9: Non Conformities

2.3.1 Non-conformities

There are three levels of non-conformity:

• Critical Where there is a critical failure to comply with a food safety or legal issue.
• Major Where there is a substantial failure to meet the requirements of a ‘statement of intent’ or any clause of the Standard, or a situation is identified which would, on the basis of available objective evidence, raise significant doubt as to the conformity of the product being supplied.
• Minor Where a clause has not been fully met but, on the basis of objective evidence, the conformity of the product is not in doubt.
  Failure to comply with the statement of intent of a fundamental requirement (i.e. a major non-conformity) leads to non-certification at an initial audit or withdrawal of certification at subsequent audits. This will require a further full audit to establish demonstrable evidence of compliance.
  The objective of the audit is to provide a true reflection of the standard of the operation and level of conformity against the Standard. Consideration should therefore be given to awarding a single major non-conformity where minor non-conformities are repeatedly raised against a particular clause of the Standard. Clustering of a significant number of minor non-conformities against a clause and recording this as a single minor non-conformity is not permitted. The certification body shall justify a high number (more than 20) of minor non-conformities where one or no major non-conformities are given. This shall be detailed on the audit report. IFS7.1: Non Conformities

IFS Scoring System

In order to determine whether compliance with an IFS Food requirement has been met, the auditor has to evaluate all requirements of the checklist (Part 2), which are classified either as regular or as KO requirements. The IFS scoring system covers a scoring range based on the level of compliance of the requirement, from full compliance to a deviation and / or non-conformity. In the IFS Food Standard, there are six (6) scoring possibilities. Points are awarded for each requirement according to the following chart (chart 1):

KO requirements

There are specific requirements in the IFS Food Standard which are named KO requirements. These requirements are essential and address key topics to be ensured by the production site to reach compliance. If the auditor identifies that the company does not fulfil at least one of these requirements during the Assessment, this results in a non-certification. In the IFS Food Standard, the following ten (10) requirements are defined as KO requirements:

• 1.2.1 Governance and commitment
• 2.2.3.8.1 Monitoring system of each CCP
• 3.2.2 Personal hygiene
• 4.2.1.3 Raw materials specification
• 4.2.2.1 Product and recipe compliance
• 4.12.2 Foreign material risk mitigation
• 4.18.1 Traceability
• 5.1.1 Internal audits
• 5.9.2 Procedures of withdrawals and recalls
• 5.11.2 Corrective actions
  Scoring of KO requirements is explained in the following chart (chart 2)

Important note:
A “B” scoring is not possible for KO requirements: only A, C or D (= KO non-conformity) scorings
are possible.
If a KO non-conformity is rated during an IFS Food Assessment, the Assessment is failed and the
next one can only be performed announced. For more information, see ANNEX 6.

Note: If an initial IFS Food Assessment is failed due to a D evaluation of a KO requirement and / or
more than one Major non-conformity, the IFS Food Assessment report shall be uploaded in the
IFS Database and this Assessment cannot be considered as a pre-Assessment

2.3.3 Follow-up Assessment

A follow-up Assessment is required in a specific situation where the results of the Assessment (initial or recertification) did not allow a certificate to be issued due to one Major non-conformity and a total scoring ≥ 75 %. During the follow-up Assessment, the auditor shall focus on the implementation of actions taken
to correct the Major non-conformity determined in the previous Assessment.
The closure of the Major non-conformity shall always be verified by an on-site evaluation by the auditor. The follow-up Assessment shall generally be performed by the same auditor who performed the Assessment where the Major non-conformity was identified. The follow-up Assessment shall be performed no earlier than six (6) weeks, and no later than six (6) months, after the previous Assessment.
If a follow-up Assessment is not performed within six (6) months of the date of the previous Assessment, a full new initial Assessment shall be performed.
If the company decides not to perform a follow-up Assessment but to start again with a full new Assessment, the new Assessment shall be scheduled no earlier than six (6) weeks after the Assessment where the Major non-conformity was issued (for further information, see chapter 4.2.1.1, Part 1). If the follow-up Assessment is failed, a full new Assessment will be necessary and shall be scheduled no earlier than six (6) weeks after the follow-up Assessment. The report of the failed follow-up Assessment shall be uploaded to the IFS Database. If the follow-up Assessment is successful, certification shall be issued at foundation level only. The different steps are explained in ANNEX 5.

In the event of a Major non-conformity, a D evaluation of a KO requirement or a total scoring
< 75 % after an extension Assessment, the full Assessment (including the main one) is failed and
the current certificate shall be suspended.

FSSC22000: Non Conformities

5.3.4 NONCONFORMITY MANAGEMENT

Nonconformities raised at multi-site organizations (refer section 5.3) shall follow the requirements of the Scheme as well as those in IAF MD1, section 7.7 with the following specific requirements in addition:
a) Where a critical nonconformity is identified, the certificate of the multi-site organization shall be suspended within 3 working days of issuing the critical nonconformity, regardless
of whether or not all the site audits have been completed.
b) Where a major nonconformity is identified and the audit takes more than 30 calendar days to complete (central function and site audits), the organization shall provide a corrective action plan including any temporary measures or controls necessary to mitigate the risk until the nonconformity can be closed.
c) The timeline for closure of nonconformities start at the end of the audit – after completion of the central function audit and all the site audits.

6.2 NONCONFORMITIES

In accordance with the definitions in the Scheme and as defined below, the Certifying Body (CB )is required to apply these criteria as a reference against which to determine the level of nonconformities for findings.

There are three nonconformity grading levels:
a) Minor nonconformity;
b) Major nonconformity;
c) Critical nonconformity.

Nonconformities shall always be written to the most relevant Scheme requirement linked to the specific audit criteria in ISO 22000:2018; the specified PRP standard or the FSSC Additional Requirement. The Scheme does not allow “Opportunities for Improvement”.

6.2.1 MINOR NONCONFORMITY

A minor nonconformity shall be issued when the finding does not affect the capability of the
management system to achieve the intended results:
1) The organization shall provide the CB with objective evidence of the correction, evidence of an investigation into causative factors, exposed risks, and the proposed corrective action plan (CAP);
2) The CB shall review the corrective action plan and the evidence of correction and approve it when acceptable. The CB approval shall be completed within 28 calendar days after the last day of the audit. Exceeding this timeframe shall result in a suspension of the certificate;
3) Corrective action(s) (CA) shall be implemented by the organization within the timeframe agreed with the CB;
4) Effectiveness of implementation of the corrective action plan shall be reviewed, at the latest, at the next scheduled audit. Failure to address a minor nonconformity from the previous audit could lead to a major nonconformity being raised at the next scheduled audit.

6.2.2 MAJOR NONCONFORMITY

A major nonconformity shall be issued when the finding affects the capability of the management system to achieve the intended results:
1) The organization shall provide the CB with objective evidence of an investigation into causative factors, exposed risks, and evidence of effective implementation;
2) The CB shall review the corrective action plan and conduct an on-site follow-up audit to verify the implementation of the CA to close the major nonconformity. In cases where documentary evidence is sufficient to close out the major nonconformity, the CB may decide to perform a desk review. This follow-up shall be done within 28 calendar days from the last day of the audit;
3) The major nonconformity shall be closed by the CB within 28 calendar days from the last day of the audit. When the major cannot be closed in this timeframe, the certificate shall be suspended;
4) Where completion of corrective actions might take more time, the CAP shall include any temporary measures or controls necessary to mitigate the risk until the permanent corrective action is implemented.

6.2.3 CRITICAL NONCONFORMITY

A critical nonconformity is issued when a direct food safety impact without appropriate action by the organization is observed during the audit or when legality and/or certification integrity are at stake:

1) When a critical nonconformity is raised at a certified organization the certificate shall be suspended within 3 working days of being issued, for a maximum period of six (6) months;
2) When a critical nonconformity is issued during an audit, the organization shall provide the CB with objective evidence of an investigation into causative factors, exposed risks, and the proposed CAP. This shall be provided to the CB within 14 calendar days after the audit;
3) A separate audit shall be conducted by the CB between six (6) weeks to six (6) months after the regular audit to verify the effective implementation of the corrective actions. This audit shall be a full on-site audit (with a minimum on-site duration of one day). After a successful follow-up audit, the certificate and the current audit cycle will be restored, and the next audit shall take place as originally planned (the follow-up audit is additional and does not replace an annual audit). This audit shall be documented, and the report uploaded;
4) The certificate shall be withdrawn when the critical nonconformity is not effectively resolved within the six (6) month timeframe;
5) In case of a certification audit (initial), the full certification audit shall be repeated.