On a desk audit do you get time to fix NC's or do you just fail?

Good morning everyone,

I'm expecting my first desk audit for a level 2 SQF certification by the weeks end. I'm starting to feel a healthy amount of anxiety as this really all falls on my head. I was curious, if my auditor finds something that does not conform or meet their liking, what is the outcome. Assuming most everything is on the covered and something that needs correcting is found do I have a window of opportunity to make the corrections or can you just FAIL your desk audit.

I had the same feelings of dread with USDA Organic certification but it went very well. I'm just curious of the protocol for items needing a bit more attention.

I haven't been through an initial desk audit, just recertification audits, but with less than 1 week to go, here would be my advice.

Findings: In general (individual auditors grade differently), SQF will issue Major findings when you have no policy of any kind to support a requirement, and minor's when you fail to either meet the entire requirement or fail to follow your policy (e.g. the paperwork is missing, or you haven't been doing an inspection you said you would). So, very quickly do a top-down review of module two and decide whether you have a specific written policy in place that addresses the intent of each requirement, and you can effectively avoid major findings with ease.

Examples: Your internal audit program and CAPA program are excellent examples of verification for a ton of different requirements, make sure you use them with a wide brush to verify systems are working and effective.

If you're using spreadsheets for any logging or trending activities, print out examples of recent and well organized weeks of use, with bonus points if they helped you identify a trend you're now taking steps to improve.

Don't oversell, be honest about your programs and their implementation and approach everything from a risk assessment perspective. See example:

 

Auditor: The policy says you'll review labels as they come in, do you have records to demonstrate that?

 

Supplier: You know, I wrote that SOP as we prepared for certification but implementation has been tough and I need to make revisions. We realized that, because our company doesn't process any products with allergens, label review isn't posing a food safety risk, so we can probably do an initial review when proofs are created, and then just work with our label supplier to make sure they supply only the current revision as part of our supplier approval program. After all, once created, the words on the label cylinders/plates can't change on their own, so the only possibility of an error would be from accidentally printing an older revision.

 

Auditor: okay, that makes sense, but you need to follow your written procedures.

 

Supplier: Of course, and I'll make modifying that SOP to follow current practice a priority.

This violates the "do what you say" idea of SQF, but especially in small companies that may have only 1-2 QA folks, making your way around to updating SOP's (especially since these are first drafts) is understandable and in good faith if you've provided a risk assessment. This approach is not appropriate for things like sanitation.

Looking at the code, since you aren't yet certified, it looks like they'll just wait to schedule your facility audit until you have completed all the corrective actions from your desk audit. No specific time limits are specified.

I wouldn't sweat it and treat the desk audit like a paid consultant is going through your stuff to prepare for your facility audit. Make sure you are prepared to explain how you meet the intent of the code if you have a unique procedure/process/product/facility, and be prepared to defend any risk assessments you've made with historical company data that is demonstrable, e.g. don't just assume "it's unlikely", be able to say "it's never happened in our facility".

As far as training goes...

Are you expected to have all employees trained and logged on programs and prerequisite programs by the time of the desk audit?

I'm playing catch up on implementation of all training and training needs. As far as production workers go, up to this point a formal training program and structure did not exist and was all done as an undocumented on the job training/ verbal instruction. But things like HACCP, crisis management, QC training goes its been done and documented.

They'll be looking for those records during your desk audit.

SQF will care mostly about food safety training. Make sure you can demonstrate how everyone has basic GMP (hand washing, etc.) training and a record. And have a good example of how you differentiate training between job descriptions (e.g. additional sanitation training for sanitation operators). It sounds like you've got that buttoned up and will be good to go, but think about how you validate that training via internal audits etc. and have a flowchart or something to show how you go about retraining by time or incident.

I haven't had an auditor get specific about what training folks need, just be able to explain how what you're doing right now leads to an understanding/culture of food safety on the floor, supports a quality-first culture (stop the line!), and that operators performing quality checks know what they're doing and why.

Thanks for the help! Much appreciated!

You do NOT get graded on your first audit (desk audit.) You get graded on the certification audit.  Your CB/Auditor should have sent you a listing of the docs they will want to review.

Desk audits can of course generate corrective actions that need your attention - 30 days for minors and 14 for majors - however, again no grading.

There are numerous training requirements throughout the 7.2 manual.

Basically you should be fully ready to roll before submitting to a desk audit.

Update:

Things went well for the desk audit! A couple minors but nothing excessive. The stress the audit brought on by impending doom helped me in being more meticulous and prompted 3 or more GAP analyses.  

To anyone who might read this topic in the future with the same questions:

Training was not complete but records were not observed at the time of desk audit. Definitely not a pass/fail scenario. Perform a GAP analysis several times and know where your documentation is or arrange it to cater to the needs of the audit. I knew where all of my documents were, very little searching, and the audit still took about 7.5 hours for a frozen food plant that receives about 90% of raw materials frozen and RTE (no cooking of meats or eggs) 

Thank you to everyone who responded to this topic and best of luck to anyone reading this in the future