SQF 2.5.1.1 Non-compliance

Hi all, 

We are a food manufacturing facility that just got audited for SQF edition 9. We have a non-compliance on 2.5.1.1 stating: "The site has not fully documented a procedure for SQF validation. The requirements are partially documented in PRP programs such as cleaning validation, premise inspection, and allergen program procedures."

I've done some research and my head is jumbled with information. As I understand it, verification is doing the actual tasks and following the schedule. Validation is confirming that the tasks are effective in maintaining our quality system. 

What should be included in the SQF validation procedure? A little lost here so any insight would help. 

Thank you!

-Kyra

How are you auditing the SQF program in full?

Hi Scotty! We are doing this by internal auditing using the SQF module 11 and module 2 requirements checklist. 

How are you auditing the SQF program in full?

Back in the day, we would say there are 4  parts to every procedure / program

1.  Say what you do - this is the written procedure (sqf for methods responsibilities, freqencies, etc.)

2.  Do what you say.   This is actions and records of those actions  

3.  Prove that you are doing what you say.   This is usually records review, etc.   also called verification

4.  Prove that what you are doing is effective.  This is validation. 

Some dissagree, but I think you need to describe both your verification and validation methods.   A simple way that I have done this is by using a basic matrix that I have attached an example.  It only has sanitation, but I would add all of those requried by SQF - HACCP, section 11 gmps, etc.  

Hmmm...did they provide more information in their findings to show you did not do this?  They should have made it pretty clear what you need to do or where you fell short.  If they didn't you need to reach out and request further clarification.

That's a good point (not sure why I didn't think of that!) - I should reach out to the auditor for clarification rather than searching and losing my mind. What I quoted is unfortunately all the info they provided.

Hmmm...did they provide more information in their findings to show you did not do this?  They should have made it pretty clear what you need to do or where you fell short.  If they didn't you need to reach out and request further clarification.

As I understand it...

Validation is the science used. 

Verification is the actual checking. 

Calibration determines the accuracy of the testing equipment.

sounds to me like you have not

A) reassessed your HACCP plan annually

and/or 

B) performed a proper internal audit annually

It's important to review the entire element the auditor quoted

The methods, responsibility, and criteria for ensuring the effectiveness of all applicable elements of the SQF Program shall be documented and implemented. The methods applied shall validate that:
i. Good Manufacturing Practices are confirmed to ensure they achieve the required results;
ii. Critical food safety limits are reviewed annually and re-validated or justified by regulatory standards when changes occur; and
iii. Changes to the processes or procedures are assessed to ensure the controls are still effective.
Records of all validation activities shall be maintained.

Guessing you have not reviewed your CCP adequately for their liking

I'd ask for clarification on the finding, as even my brain is going in a couple different directions based on the language they used in your finding.  I'm thinking two different aspects:

1.  You're validating your programs through review, ensuring they meet your own requirements, but not showing how the program itself meets SQF requirements.  It's one thing to say "Our EMP results prove sanitation procedures are meeting our needs, and review of sanitation logs show the program is being followed at proper frequency," but it's another to say "the review to validate our sanitation program meets SQF x.x.x.x requirements.

2.  You might need to list completing the SQF checklists into your own SOP's at whatever frequency you determine.  A lot of us run through the SQF checklist before the audit or audit window, but unless your SOP's for Verification and Validation state this checklist must be done, there's technically no way someone running your program would know to go do that checklist.  And that could be what they're looking to see.

Hi all, 

 

We are a food manufacturing facility that just got audited for SQF edition 9. We have a non-compliance on 2.5.1.1 stating: "The site has not fully documented a procedure for SQF validation. The requirements are partially documented in PRP programs such as cleaning validation, premise inspection, and allergen program procedures."

 

...

Not knowing anything else, I would guess you lack a documented schedule for reviewing your programs.

A simple tabular sheet that says a person with this title will review these policies or parts of the code once annually.  Maybe you assign some sections to this quarter, and some others to the second quarter etc., it doesn't have to be elaborate.  Just say who, what and how often; then maintain a sheet recording that it happened with dates and signatures.

It's important to review the entire element the auditor quoted

The methods, responsibility, and criteria for ensuring the effectiveness of all applicable elements of the SQF Program shall be documented and implemented. The methods applied shall validate that:
i. Good Manufacturing Practices are confirmed to ensure they achieve the required results;
ii. Critical food safety limits are reviewed annually and re-validated or justified by regulatory standards when changes occur; and
iii. Changes to the processes or procedures are assessed to ensure the controls are still effective.
Records of all validation activities shall be maintained.

Guessing you have not reviewed your CCP adequately for their liking

Thank you everybody for the feedback! I'm gathering a much better understanding after sleeping on it and reading all your comments. 

Thank you for the input! This is very helpful in gathering a better understanding. 

-Kyra

Back in the day, we would say there are 4  parts to every procedure / program

 

1.  Say what you do - this is the written procedure (sqf for methods responsibilities, freqencies, etc.)

2.  Do what you say.   This is actions and records of those actions  

3.  Prove that you are doing what you say.   This is usually records review, etc.   also called verification

4.  Prove that what you are doing is effective.  This is validation. 

 

Some dissagree, but I think you need to describe both your verification and validation methods.   A simple way that I have done this is by using a basic matrix that I have attached an example.  It only has sanitation, but I would add all of those requried by SQF - HACCP, section 11 gmps, etc.  

Hi Scampi,

We do both of these things and maintain records of all changes. Maybe the SOP is not to their liking? 

sounds to me like you have not

 

A) reassessed your HACCP plan annually

 

and/or 

 

B) performed a proper internal audit annually

Back in the day, we would say there are 4  parts to every procedure / program

 

1.  Say what you do - this is the written procedure (sqf for methods responsibilities, freqencies, etc.)

2.  Do what you say.   This is actions and records of those actions  

3.  Prove that you are doing what you say.   This is usually records review, etc.   also called verification

4.  Prove that what you are doing is effective.  This is validation. 

 

Some dissagree, but I think you need to describe both your verification and validation methods.   A simple way that I have done this is by using a basic matrix that I have attached an example.  It only has sanitation, but I would add all of those requried by SQF - HACCP, section 11 gmps, etc.  

Would this matrix suffice in proving that both validation and verification is done?

Would this matrix suffice in proving that both validation and verification is done?

It is a schedule for both sets of activities.  You will need meeting notes, signatures on policies, or some other type of documentation to establish you did what you said in the example matrix.

It is a schedule for both sets of activities.  You will need meeting notes, signatures on policies, or some other type of documentation to establish you did what you said in the example matrix.

Sounds simple enough but I keep overthinking it.  Thanks!  

This is good input, thank you! To me this sounds more like verification, please correct me where I'm wrong. It's been a process for me to separate the two. 

 

Not knowing anything else, I would guess you lack a documented schedule for reviewing your programs.

 

A simple tabular sheet that says a person with this title will review these policies or parts of the code once annually.  Maybe you assign some sections to this quarter, and some others to the second quarter etc., it doesn't have to be elaborate.  Just say who, what and how often; then maintain a sheet recording that it happened with dates and signatures.

 

2.5.1.1 The methods, responsibility, and criteria for ensuring the effectiveness of all applicable

elements of the SQF Program shall be documented and implemented. The methods

applied shall validate that:

i. Good Manufacturing Practices are confirmed to ensure they achieve the required results;

ii. Critical food safety limits are reviewed annually and re-validated or justified by regulatory

standards when changes occur; and

iii. Changes to the processes or procedures are assessed to ensure the controls are still effective.

 

Records of all validation activities shall be maintained.

 

This is good input, thank you! To me this sounds more like verification, please correct me where I'm wrong. It's been a process for me to separate the two. 

I suppose the devil is in the details of what constitutes a "review".  This annual or monthly process might incorporate additional information that indicates your programs are failing/succeeding to do what they were designed to accomplish, like consumer complaint feedback, trends in verification results, etc.

I see what you're saying! Very true point, thanks for clarifying. 

-Kyra

I suppose the devil is in the details of what constitutes a "review".  This annual or monthly process might incorporate additional information that indicates your programs are failing/succeeding to do what they were designed to accomplish, like consumer complaint feedback, trends in verification results, etc.

This is very helpful - thanks so much for the example! 

Take care,

-Kyra

Back when SQF went to version 7.2 I attended a training on SQF and when the topic of Verifications and Validations was discussed the trainer gave us a suggestion to set up an Excel file or a chart in Word and list out each element of the code and then describe how you will verify that element and then how you would validate that element.  Then assign the frequency for which each should be done. 

 

All of our validations are assigned Annual frequency, verification depends on the element.  It was suggested to use reviews of sampling results, corrective actions and customer complaints, if they fit the element, to help in the validation to show system is working if you are not having any trends.  Unfortunately we did not find them to fit all so we did have to get creative with some of the elements.

 

I have attached a document with the format and some examples of the suggestions discussed in the training.  This format has worked for us to satisfy the auditors that have been at our facility since then.  

 

Some people will argue that you are not required to validate anything but CCP's and while scientifically or in theory that may be the case, unfortunately for SQF Certification you are required to meet the code.  There are different options to do so but whatever you do ensure you have the needed documentation to support it.  We compile the annual data on sampling results, corrective actions and customer complaints and type up summaries of the data and utilize graphs to make it pretty for the elements of the code they can apply to.  The auditors seem okay with what we have done as have not received a non-compliance and we have had a few different auditors since the code implemented the validation requirement..