Why do you have the rules and standards you have?

The post about jewellery / jewelry and FDA rules got me thinking.  

Why do you have the rules you have?

At many of the sites I've worked at, we had rules because they were defined externally but when I started in the food industry, I approached it all from an ethical / food safety standpoint.  It was internal auditing training that beat that out of me.  Always refer to the standard and gaps to the standard...

Now I'm old(er), ok, old, I think I was right as a fresh faced 20 something and wrong to have been waylaid.

We seem to have forgotten food safety in all of this and it's all about protecting and not hurting the consumer.  It's not (at least first and foremost) about good audit scores, protecting brands etc etc.

Fun topic lol.  I voted that I have rules to protect consumers and also to comply with GFSI or customer requirements.  Every business I've worked with in my roughly 15 years always ends up having a few Senior Positioned Senior Citizens who are reluctant to accept change.  "Oh, that issue you discovered ain't never made someone sick, it'll be fine."  If they don't want to listen to actual reasoning of why we should change a practice, it's helpful to be able to push them over to complying with a written rule from either FDA/USDA, OSHA, GFSI, or our own customers.  "Yeah Frank, I get keeping a jug of gear oil next to the machine probably ain't going to kill someone, but SQF demands we lock it up and OSHA would be peed to see an untrained employee is using it without training."

Ethics count just as much, as in I'll walk long before I stand for something unethical.  But 99% of the time I can use codes or protecting a customer from harm as a logic-based reason to enact a policy or program change.

A follow up question.  Are GFSI helping this?  As in are they helping prevent food safety issues or are they encouraging compliance with a standard?

Well, compliance with a standard is to ensure food safety. I don't know what exactly you mean. 

I don't think the two are necessarily the same.  Let me give you an example.  If you have something that is not a risk from a food safety perspective, but it's a compliance clause of the standard, with most GFSI auditors, I've found you have to document the risk assessment or risk it being raised because it's in the standard.  

Another example demonstrating a different but similar issue.  I believe most auditors audit compliance to the standard not risk.  So for example, an auditor will check that your engineering manager turns up to a HACCP meeting but won't check they actually have any actions assigned to them or that engineering related food safety hazards are well assessed.  They will check that internal audits are done, not that they were sufficiently challenging in light of their findings (only M&S has ever done that in my experience).  They will ask for the PPM on "x" equipment which you might have four of and accept the first their shown not look at all four PPMs and make sure all are being done.

On the latter paragraph, I don't think it's just auditor inexperience (although I believe it's part of it), I think the standard encourages you to be insufficiently challenging.  To stop at the first sign of compliance, not, to do as I was taught many moons ago, to follow your nose of "this doesn't feel right" or to dig in a bit deeper and not just accept surface compliance.

A follow up question.  Are GFSI helping this?  As in are they helping prevent food safety issues or are they encouraging compliance with a standard?

Let's say 'they mean well', eh?   But yeah, I get your point....

Let's say 'they mean well', eh?   But yeah, I get your point....

Yes, I absolutely get that the intent is food safety but, here's another example...

How many times have you done a:



...with an auditor?

You know the "oh crap...  Look I'll sort that out later.  He / she doesn't need to see it..."?

We all have.

But if the audit was about making safe food, why would we do that?  Why would we celebrate a good result in a factory we know had some elements of "stage management" to put it kindly...

I see what you are saying. I feel like GFSI has taken it few steps ahead (maybe unnecessarily, but to be on safe side) on food safety. And auditors are claiming to do their jobs by making you adhere to the standards. Even they are aware it is nonsense, which is why their response is "here it says in BRC 4.2.3 etc." when you disagree with their NCs. 

I think the purpose of the standard, and to most written rules, is to leave as little to interpretation as possible. For example, we once had a discussion in here about keeping track of and documenting the temperature in the fridge in the employee breakroom. Quite a few of you non Murica' folks said 'yeah, of course you should do that' when myself and several others here stateside said 'hell no, that's the most nonsensical thing I've heard of today! What does that have to do with food safety of our product?'

Anyway, iirc we agreed to disagree. But when something is laid out in the standard in black and white, you do it or better have a damn good risk analysis as to why you don't (except with AIB, they say do it or don't get your AIB cert).

I also had an issue (differing opinion) with knife control, and employee lunches in the lockers in the employee breakroom. But the standard was pretty clear, so I follow the standard. 

Just curious - what issues did you have with knife controls and employee lunches?

Monitoring Lunch room fridge temperature is laughable. Was the reasoning to keep staff members from eating stale food and workplace neat or something else? 

We once had a falling out with an auditor about a walk in fridge and she said we'd not done an extensive mapping study to work out the warm spots to place our probes.  I pointed out that in a cold warehouse, I'd completely agree but this was a c. 4 pallet space fridge.  It wasn't vast.  She backed down in the end but this is where inexperience and naivety butt up against "come on, this is obviously not common sense" and then the safety blanket of "the standard says..." comes out unless s/he's seen the setting of your jaw that says "just bloody try me..."

A follow up question.  Are GFSI helping this?  As in are they helping prevent food safety issues or are they encouraging compliance with a standard?

GFSI does help me in this regard.  I could list a few examples, but without going into one of my long paragraph story times, it's helpful for me when an owner or manager wants to dismiss a practice or change an SOP.  They might give me 50 reasons for why they think it's a good idea, or why it's not going to be harmful, or say I'm overreacting, but being able to hold up a GFSI backed reason for why we're going to do something gives it teeth.  It's helped when I'm a staff member at a plant and when I'm just in helping in a consulting role.

Monitoring Lunch room fridge temperature is laughable. Was the reasoning to keep staff members from eating stale food and workplace neat or something else? 

I think one of my stories is the source on here for this lol.  Customer sent an "auditor" to check us out, ol' timer who really seemed like he had nothing better to do.  He checked the break room as normal, then told me, "Oh, you're an SQF facility but you're not regularly monitoring the employee refrigerator?  That's an SQF requirement!"  No, it's not.  SQF merely requires I give the employees a refrigeration and heating facilities.  Dude made it a finding in his report and demanded a CAPA, which we replied with "Independent and certified SQF auditors found current practices meet standard 11.3.5.9(iv), we will not be making changes at this time."

I believe the reasoning for the standard is to ensure there's an option to keep their lunches cold in the breakroom, so they're not tempted to take their lunches with them and store them with your inventory.

Just curious - what issues did you have with knife controls and employee lunches?

 

Monitoring Lunch room fridge temperature is laughable. Was the reasoning to keep staff members from eating stale food and workplace neat or something else? 

My issue isn't with all knife control, simply that in my facility knives are used solely on secondary packaging (boxes, plastic labels). Bottles are filled and then capped 2 feet after fill. The system is closed, what's the risk? Cutting a bottle with a 'dirty' knife? It would leak and be sent for rework (complete refiltering). How do I know a chipped blade isn't going to end up in the product? What's the chance someone chips a blade and it falls off in the 3 seconds from fill to cap, into that little bottle opening? 

Lunches in lockers in the lunchroom? We have pest control monitoring stations at both sides of the lockers and PCO inspects twice monthly. It is not near an entrance, and it has never ever ever had any hits. And now people have to put their unrefrigerated lunches on tables, which is kinda crappy.

But, I have a knife control program, and I have a sign and locker inspections monthly to verify people aren't putting food in their lockers. Because it's in the code. Sometimes that's the way the cookie crumbles.

GFSI does help me in this regard.  I could list a few examples, but without going into one of my long paragraph story times, it's helpful for me when an owner or manager wants to dismiss a practice or change an SOP.  They might give me 50 reasons for why they think it's a good idea, or why it's not going to be harmful, or say I'm overreacting, but being able to hold up a GFSI backed reason for why we're going to do something gives it teeth.  It's helped when I'm a staff member at a plant and when I'm just in helping in a consulting role.

 

But is that really helping you?  Is it helping you win the battle but lose the war?

"The standard says so" is the crappiest reason I know to convince someone who is arguing with me that they disagree in the reason for an SOP or control measure.  If I have to resort to that, I feel like I've failed.  Why have I failed?  Because the other person walks away thinking all technical people are clipboard wielding compliance freaks who don't live in the real world and make you do BS rules for the hell of it.  Whereas if they walk away knowing why it's important and understanding the real risk, they walk away more likely to ensure their team comply with that SOP going forward but what's more and better, more likely to communicate the "why" to them too.

But is that really helping you?  Is it helping you win the battle but lose the war?

 

"The standard says so" is the crappiest reason I know to convince someone who is arguing with me that they disagree in the reason for an SOP or control measure.  If I have to resort to that, I feel like I've failed.  Why have I failed?  Because the other person walks away thinking all technical people are clipboard wielding compliance freaks who don't live in the real world and make you do BS rules for the hell of it.  Whereas if they walk away knowing why it's important and understanding the real risk, they walk away more likely to ensure their team comply with that SOP going forward but what's more and better, more likely to communicate the "why" to them too.

I replied assuming it was a given that any QA person worth their salt would've already worked to present the actual risk, encourage understanding, redo training, etc., all the logical steps to help gain compliance and make safe food.  I was citing examples where a member of management has been given the logic and reasoning and still won't come to compliance.  GFSI regs, FDA regs, USDA regs, etc., those are the extra tool on a QA's belt to promote compliance.

I replied assuming it was a given that any QA person worth their salt would've already worked to present the actual risk, encourage understanding, redo training, etc., all the logical steps to help gain compliance and make safe food.  I was citing examples where a member of management has been given the logic and reasoning and still won't come to compliance.  GFSI regs, FDA regs, USDA regs, etc., those are the extra tool on a QA's belt to promote compliance.

Ah but not all do.  At least not all that I have encountered.  

I had one today where there was a shelf life issue and the person didn't know why it was limited to a certain value, especially as it was routinely extended.  I told him to ask.  He'd apparently asked before and been told it was a "standard".  

I was once working for a company supplying M&S and the weight control procedure at the time for that company made zero sense.  I refused to put into place a check which would do nothing to actually confirm the checkweigher was effective.  In the end, I contacted the person who wrote the standard, went to head office and put my case to him.  I'd rather do that every day than just give into the "the standard says so..." or if my knowledge is insufficient to understand it, I improve my knowledge.

Ah but not all do.  At least not all that I have encountered.  

 

I had one today where there was a shelf life issue and the person didn't know why it was limited to a certain value, especially as it was routinely extended.  I told him to ask.  He'd apparently asked before and been told it was a "standard".  

 

I was once working for a company supplying M&S and the weight control procedure at the time for that company made zero sense.  I refused to put into place a check which would do nothing to actually confirm the checkweigher was effective.  In the end, I contacted the person who wrote the standard, went to head office and put my case to him.  I'd rather do that every day than just give into the "the standard says so..." or if my knowledge is insufficient to understand it, I improve my knowledge.

Short answer to the original question (thread title): General people's ignorance.

A follow up question.  Are GFSI helping this?  As in are they helping prevent food safety issues or are they encouraging compliance with a standard?

We are a 3PL and it's all compliance going from AIB to SQF (customer requirement). The documentation part of it is the hardest and even a year in it's a HUGE struggle to get everyone to keep up and not get complacent by falling back to old habits of doing, but not writing down they've done it.  

We are a 3PL and it's all compliance going from AIB to SQF (customer requirement). The documentation part of it is the hardest and even a year in it's a HUGE struggle to get everyone to keep up and not get complacent by falling back to old habits of doing, but not writing down they've done it.  

I have a lot of time for AIB.  Yep I know PCA but what AIB auditors do is spend A LOT of time in the factory seeing what actually happens and looking deeply into sanitation etc.  The systems element is less important to them and more a back up to what they've seen.

In my experience, GFSI audits are almost the other way.  Even if the site tour is often first, it's like the system compliance takes primacy.  So for example, an AIB auditor will check maintenance by looking for a piece of equipment to be dismantled and looking at the risks present, e.g. over lubrication, wear, leaking oil.  They will look at systems but they'll spend far longer looking at the actual example.  A GFSI auditor will generally ask to see the records that it was done.  Same with cleaning.  An AIB auditor will be looking into tanks.  A GFSI auditor might if it was empty but will mainly focus on the records.

It comes a bit to auditor competence.  Not that AIB are struggling any less than other CBs in getting auditors with experience of course.  

One thing that's really interesting to do is to have AIB audit you against a GFSI standard as the CB.  I had that for BRCGS and while they did do the systems stuff, I'd say they brought that "factory first" mindset to something which can be too systems based and were the only auditors that actually spent the time in the factory they're meant to.  Even then though it was still pages of "let's do the VACCP study..." now.  

I'm not saying it's not important.  It is.  But there is so much which can go wrong between what happens on paper, even what's recorded on paper and what happens actually in real life.

How often have you failed a GFSI certified manufacture?   We have.  No allergen control/storage program?  Allergen control program where all allergens are open in the weighing room at the same time? So focused on shoe changing, but outside employee walked right through production without protective clothing?

Heavy reliance on risk assessments. Documentation of the risk assessment takes longer than actually doing the risk assessment. Documentation of Management meetings, emails, teams calls, etc. but does what you are documenting have anything to do with food safety? 

GFSI but our customers still require on-site audits, long questionnaires.....  Tell them no!  That doesn't work.

Best is when our customer is actually one of our vendors and they require us fill out forms and provide documents that they refuse to fill out for or give us!