BRCGS Clause 3.11.3 - Incident management test must include a recall test?
Strictly speaking the auditor is correct, although I would maybe have phrased it differently. You need to test your crisis management plan at least annually and that test needs to include a recall/withdrawal test.
There is nothing wrong, and in actual fact I strongly encourage, with you doing a seperate crisis management test that does not include this - for example major service disruption.
So long as your recall test included the crisis management elements and you do that at least annually you are fine.
When I run my mock crisis scenarios, I only include product trace if it's related specifically to distinct products. Most of the time we invent scenarios that involve the plant itself (weather crisis, fires, utility failures, etc.), which would make a product trace irrelevant. We do mock recall and traceability checks separately, both from each other and separate from the mock crisis. Though I'm not BRC so I can't speak to whether this is accurate for that specific scheme, but it seems okay in other GFSI schemes generally.
The Interpretation guide says this for Clause 3.11.3:
"The incident management procedure must be tested at least annually. This test must include a test of the product withdrawal and recall processes which form part of the incident management procedure."
So that seems pretty cut and dried. HOWEVER, Clause 3.11.1 states this:
Where products which have been released from the site may be affected by an incident, consideration shall be given to the need to withdraw or recall products."
So, if the scenario whereby you test your "incident management system" does not include products that have left the site, do you need to do a mock recall as well?
That's a question to challenge the auditor with.
Marshall
Hi ;)
I did both, sometimes is better to do more than less.
But, the BRC shall be challenged on this.
;)
If you want to test leadership behaviours in a non recall based incident, which is good practice to do as well, why not link up with EHS colleagues who will no doubt want to do something similar and do something combined? Eg loss of power, fire, flood? But for BRC I think the auditor is right.