Getting Food Safety Certification requires passing an audit. Passing an audit requires having a Food Safety System with all the supporting documentation. In order to develop a Food Safety System system the steps are as follows:
1. Choose your Standard - Which level you want to be certified to - GMP or GFSI? And within each level, which standard specifically? While there's much is common between them the standards are different enough so you want to make sure that you're developing your system according to the exact standards to which it will be audited. Part of the decision is based on which certification current and potential customers require. See https://www.linkedin.com/pulse/food-safety-certifications-david-strait/?published=t for an overview of the different standards.
2. Conduct a Gap Assessment - Assess your current system in reference to the chosen standard to see what you have and what you don't - the "gap" is the gap between where you are now and where you need to be. This is assuming the company already has an existing food safety system which needs an upgrade; if a company has nothing then you can skip this and simply start building a system from scratch.
3. Learn the Requirements - The next step is to educate oneself in these standards, all of which are in writing and available for download (free or for purchase, depending on the standard), so anybody that wishes can obtain and read the exact requirements to which they will be audited. In addition, many of the GFSI schemes have training courses on their standards and schemes taught by licensed trainers.
4. Plan the Project - Based on what you learned about the requirements and during your gap assessment it should be clear what needs to be done, so now you can translate that into a practical plan of action with timelines in order to get it done.
5. Identify Your Team - Who are the people that are going to developing and implementing this system and/or who are the people that will be managing it - keeping it running once it's implemented. If it's one person doing everything think again - this is a management system which means that it needs to involve multiple key people in the company. It may be useful to engage a consulting firm to help develop the documentation, implement new programs, manage the project, and give guidance on compliance. This is optional, and many companies choose to develop their own systems without outside help. With a consultant though your own company personnel will still need to manage the system.
6. Build Your System - Now begins the hard work of building a system (or upgrading the system if one is already in place) – that means writing documents, implementing new practices, training and retraining both staff and management, putting systems in place for monitoring and verifying the practices and maintaining the documentation, and getting all needed purchases and renovations for the facility.
7. Check Your System - Once you think that your system is fully up and running go back and check it again in reference to the standard to make sure that you didn't miss anything or that any of the new processes and procedures are not working. This could be done by yourself, by you consultant if you used one, or by your actual auditor by having a formal Pre-Assessment Audit, which is an unscored audit conducted by the Certification Body to give feedback and give you a chance to make final improvements prior to having the real audit.
8. Hire an Auditor - Once the system is fully developed or well on the way, arrangements need to be made to have a certification audit, the first step of which is to hire a Certification Body (CB). That means getting quotes (best to get them from several companies and compare), signing an agreement, and scheduling the audit. It's best to start this process at least 2 months before you want the audit so that the dates you want will be available.
In terms of timing, it’s a general rule of thumb to have 2-3 months of completed records prior to having the first audit. The reason for this is that an auditor cannot audit good intentions; the system has to be up and running for long enough to see that it’s a working system. Assuming that it takes 1-3 months to implement the system, the entire process should take 3-6 months from the time you begin the process until the audit (of course it can take longer for companies that move slower). |
9. Have an Audit - On the schedule day, you'll have your certification audit during which your auditor will review your system and facility in reference to the code and issue non-conformances for any deviations. By the end of the audit you won't have your official score or report yet but you should know if you passed and what are the findings.
10. Submit Corrective Actions - GFSI standards require any finding to be closed out by submitting corrective action after the audit, so it usually takes another month after the audit before they receive certification. That certificate can then be sent to customers as proof that the company passed their audit and meets the required standards. In GMP audits you can skip this step - the audit is the end of the process; no corrective action required
11. Receive Your Certificate - You did it! Don't forget to but a nice frame & post it up.
12. Now Keep it Up - Now that you're certified you still need to keep up all the systems and documents that you put in place. It's less work going forward since implementation is over and now you just need to maintain, but that's challenge is in keeping it going long term, plus updating the system as needed. Remember the certificate is good for a year so when one audit is done, the next audit will be coming up in 12 months.
