Site Security Assessment, Food Defense Test and Vulnerability Assessment

I work for a Winery and we are going for our first SQF Certification in a few months (we produce wine from inception of grapes all the way to bottling). I started 6 months ago and while I've got 10+ years HACCP experience, I'm brand new to SQF.

 

About 1.5 years ago we had a consultant come and perform an assessment. Below are a few non-compliances he noted during his desk audit, though since this was before I was hired I don't have much context from his answers and was hoping to get some insights from others:

 

1. Crisis Management - Committee must review the response and ability to address a crisis through review of the plan and performing a mock crisis (2.6.4.2)
2. Site Security Assessment must be conducted (2.7.1.4)
3. Food Defense Tests have not been conducted (2.7.1.4)
4. Vulnerability assessments have not been conducted in order to create a mitigation plan if needed (2.7.2.2)

_____________________________________________________________________________________________

 

Crisis Management Question

• Can anyone give me an example of how they performed their mock crisis?

Site Security Question

• We just had a third-party audit conduct a Site Chain Security Audit for a customer (full-day audit through a certified auditing body). We received a perfect score, so I was hoping this might be enough to suffice this requirement?

Food Defense Test Question

• Can anyone give an example of how they performed their Food Defense Test?

Vulnerability Assessment Question

• The module he noted (2.7.2.2) actually refers to Food Fraud Mitigation, so I'm guessing he means we need to conduct a Food Fraud Vulnerability assessment? Can this be added to our Hazard Analysis and have our Food Safety team conduct a risk assessment? Confused on this one

 

Any help is greatly appreciated. 

Hi Nate since it has been a year and a half and you are new to SQF may I suggest getting another consultant to work with even on a remote basis and pushing your SQF cert audits further out

Crisis Management Question

• Can anyone give me an example of how they performed their mock crisis?

you basically make up a crisis and write a detailed description of what you will do an who will do it.     make sure to also include the food safety side of the crisis

For instance, if your crisis is a fire you would want to include that product is placed on hold and evaluated prior to release, cleaning, etc 

 

 

Site Security Question

• We just had a third-party audit conduct a Site Chain Security Audit for a customer (full-day audit through a certified auditing body). We received a perfect score, so I was hoping this might be enough to suffice this requirement?

Food Defense Test Question

• Can anyone give an example of how they performed their Food Defense Test?

the most used test is to have a non employee try to enter your facility.     record findings and corrective and preventative actions as needed.   there are some good/ humorous stories on this site.   

 

Vulnerability Assessment Question

• The module he noted (2.7.2.2) actually refers to Food Fraud Mitigation, so I'm guessing he means we need to conduct a Food Fraud Vulnerability assessment? Can this be added to our Hazard Analysis and have our Food Safety team conduct a risk assessment? Confused on this one

no it would not really be included in your hazard analysis.    Search this site or google VACCP or food fraud assessment / template.   there are so many, - its kinda a preference on what will work for you.   I have one I can send to you as well.   (I'm away from the pc and will have to redact it a bit)

 

 

Any help is greatly appreciated. 

I work for a Winery and we are going for our first SQF Certification in a few months (we produce wine from inception of grapes all the way to bottling). I started 6 months ago and while I've got 10+ years HACCP experience, I'm brand new to SQF.

 

About 1.5 years ago we had a consultant come and perform an assessment. Below are a few non-compliances he noted during his desk audit, though since this was before I was hired I don't have much context from his answers and was hoping to get some insights from others:

 

1. Crisis Management - Committee must review the response and ability to address a crisis through review of the plan and performing a mock crisis (2.6.4.2)
2. Site Security Assessment must be conducted (2.7.1.4)
3. Food Defense Tests have not been conducted (2.7.1.4)
4. Vulnerability assessments have not been conducted in order to create a mitigation plan if needed (2.7.2.2)

_____________________________________________________________________________________________

 

Crisis Management Question

• Can anyone give me an example of how they performed their mock crisis?

Site Security Question

• We just had a third-party audit conduct a Site Chain Security Audit for a customer (full-day audit through a certified auditing body). We received a perfect score, so I was hoping this might be enough to suffice this requirement?

Food Defense Test Question

• Can anyone give an example of how they performed their Food Defense Test?

Vulnerability Assessment Question

• The module he noted (2.7.2.2) actually refers to Food Fraud Mitigation, so I'm guessing he means we need to conduct a Food Fraud Vulnerability assessment? Can this be added to our Hazard Analysis and have our Food Safety team conduct a risk assessment? Confused on this one

 

Any help is greatly appreciated. 

Hi NCN,

 

All the SQF queries in yr Post are "addressed" in numerous posts on this Forum (including some specific examples but afai can recall not wine oriented) however there are (predictably) a variety of apparently equally auditorially acceptable responses. (I have never used SQF personally however based on Posts in this Forum my conclusion is that there is a much wider dispersion within their auditors' interpretations of the SQF Code as compared to, say, BRC. And this has been further aggravated by the substantial, IMHO negative, change in the SQF Guidance system introduced with SQF9).

 

Not sure if you have a related technical background but one particular quirk of SQF is the absolute necessity for a Practitioner/"General" who's Scope/Responsibility will presumably cover all the queries in yr Post. If not yet designated, suitably qualified candidates may well come with inbuilt solutions to yr Post.

If otherwise, the width of yr queries looks maybe commensurate with considering another, follow-up, Consultant along with their SQF Manual :smile:.

 

Offhand, I opine that yr last query is the most vexatious one since its Scope/Interpretation is potentially extremely wide although the latter is dependent on the simplicity of the Product/Process. The only good point is that I suspect auditors now equally despair of seeing model responses so that have been obliged to accept almost any logically intelligible presentations.

Also note:  there has been a code revision since the consultant was there, so you may need to refer back to the previous version to see exactly what they were talking about

Hi Nate since it has been a year and a half and you are new to SQF may I suggest getting another consultant to work with even on a remote basis and pushing your SQF cert audits further out

Thanks, but that's not possible. We've actually made significant progress, there are just a few items which we need to shore up before our audit. 

Thanks, but that's not possible. We've actually made significant progress, there are just a few items which we need to shore up before our audit. 

 

Have you been able to attend an Implementing SQF Principles course? When I first moved to an SQF plant soon to be audited, I told them I needed a course with instructors who could guide me.  Very Very Very helpful, plus you can bounce around ideas with others in your shoes, and they really help you determine and understand ways to conduct verifications and validations.

 

If you have time before the audit, I would look into one of those courses, best thing I did for my SQF journey.