There is no question about it—organizations across nearly every industry are relying more heavily on information technology (IT) to carry out daily tasks, connect staff, and manage operations. Technology can also play a vital role in managing compliance requirements.

For example, we recently shared a case study demonstrating how leveraging a simple Microsoft SharePoint®-based Compliance Management System (CMS) has provided Southeast Missouri State University (SEMO) with access to the data, documents, systems, and processes required to help employees effectively manage compliance requirements—even when working remotely.

Tips to Design a Successful CMS

A CMS is used to coordinate, organize, control, analyze, and visualize information to help organizations remain in compliance and operate efficiently. When building a CMS, it is important to follow a process to design a system that provides the functionality to meet current requirements and the flexibility to anticipate future needs.

The following eight tips can help ensure you end up with the right CMS and efficiency tools to support your organization for the long term:

1. Inventory your existing systems – Identify how you are currently managing your compliance needs/requirements. What’s working well? What isn’t working? Do the systems work together? Do they all operate independently? This inventory should evaluate the following:
   • Current systems and tools
   • Status and functionality of existing processes
   • Data sources and ability to pull information from various sources
   • Organizational complexity
   • Compliance status
   • Existing management systems
     
2. Determine your business drivers – Are you looking to save time? Create efficiencies? Provide access to enable employees to work from home? Reduce the number of resources required? Have better access to real-time information? Answer to senior management? Respond to regulatory requirements? These drivers will also drive the decisions you make when it comes to module development, dashboard design, reporting, and more.
   
3. Understand the daily routine of the individuals using the system – Systems and modules should be built according to existing daily routines, when possible, and then implemented and rolled out in a way that encourages adoption. Having a solid understanding of routine tasks and activities will ensure the system is built in a way that works for the individuals using it—and for the way they will be accessing it.
   
4. Understand your compliance requirements – Do you have permitting requirements? Does your staff need training? How do you maintain your records? Are there regular (e.g., annual, semi-annual) plans and/or reports you need to submit? Do you have routine inspections and monitoring? All these things can and should be built into a CMS so they can be managed more efficiently.
   
5. Get the right parties involved – There are many people that touch a CMS at various points in the process. The system must be designed with all these users in mind: the end user entering data in the field, management who is reading reports and metrics, system administrator, office staff, etc. A truly user-friendly system will be something that meets the needs of all parties. If employees are frustrated by lack of understanding, if the system isn’t intuitive enough, if it is hard to put data in or get metrics out, the system will hold little value.
   
6. Make your wish list – While you may start your project one module at a time, it is important to define your ultimate desired end state. In a perfect world, how would the CMS operate? What parts and components would it have? How would things work together? What type of interfaces would users have? You may build piece by piece, but you must develop with the end in mind.
   
7. Set your priorities, budget, and pace – What is the most important item on your list? Do you want to develop modules one at a time or as a fully functional system? It often makes sense to start where you already have processes in place that can be more easily transitioned into a new system to encourage user buy-in. Priorities should be set based on ease of implementation, compliance risk, business improvement, and value to your company.
   
8. Select the right consultant – For a CMS, it is valuable to have a consultant who doesn’t just understand technology but also understands your operational needs, regulatory obligations, and compliance issues. More than likely, off-the-shelf software will not be a silver bullet compliance solution. A consultant who can understand the bigger picture of where you want to go and will collaborate to design the right CMS and efficiency tools will bring the most value to your organization.

These tips can help ensure any organization designs and develops the right CMS—one that works within the organization’s operating environment—to reduce compliance risk, create efficiencies, provide operational flexibility, and generate business improvement and value.

During the life of a food or food material plant, periods may exist where interruptions in normal operations occur. Whether the plant is partially shut down, idled, or completely shut down, it is essential that the physical plant, equipment, and processes be adequately maintained to eventually resume operations.

In order to restart, companies must ask:

• What practices must be followed to ensure proper condition for food and food contact materials manufacturing?
• How should recommissioning proceed?
• To what level should assessments be conducted to ensure proper operating conditions that protect against any potential contamination or risks?

Avoiding Catastrophic Consequences

Historically, re-startup after extended shutdown, maintenance, or upgrades with idle periods and/or equipment not being maintained for an extended period can cause significant and sometimes catastrophic issues. While some of these issues may not occur during a market-level shutdown, attention to recommissioning the site and plant needs to follow the same high level of inspection, review, and corrections, even from a non-critical event. That being said, particular attention must be given if shutdown follows an emergency response (e.g., an incident where bodily fluid is released; a building issue like fire, flood, storm; major catastrophic damage).

Vulnerability Assessments

Plants must verify their capacity to restart according to all regulatory and compliance requirements. Each area or zone of the site/plant must be maintained or brought back up to the proper standards. A large part of this involves identifying vulnerabilities at actionable process steps within a facility, including sanitation, employee requirements, equipment, and operations. For each point, step, or procedure in the facility’s process, elements must be evaluated for Hazard Analysis and Critical Control Points (HACCP) compliance, including rates, operations to hygiene, and critical time/temperature (e.g., will line speeds impact cooking and kill steps?).

Consider severity and scale of any potential impacts/vulnerabilities on health, including such areas as the volume of product or the number of servings to the number of exposures that could occur from contaminated condensates. Consider broader issues like how fast the food moves through the distribution system and possible number of illnesses and deaths. These broader factors should be used to determine significance, severity, and likelihood and to then update controls for hygiene, sanitation, and disinfection.

Enhanced Inspections

It may also be prudent to conduct enhanced inspections and maintenance for unexpected issues associated with limited operations or shutdown periods. It is important to ensure the following:

• Condition of premises and site meet requirements of business licenses.
• External building conditions, including all mechanicals, roofs, exterior walls, drainage, and pest control are functioning according to design and food safety systems.
• Internal building envelope (non-exposed food), utilities, and general controls (e.g., air filtration/conditioning, waste, lighting, pest control, security, intentional adulteration controls) are inspected, maintained, and operating at approved levels.
• Food processing and storage, including temperature controls, cooler operations, and sanitation have been tested and verified.
• Food Safety Management System (FSMS) is established and maintains all changes via Management of Change (MOC) procedures, verification, and records.

Best Practices

Based on the data gathered through vulnerability assessments and enhanced inspections, companies can determine what changes need to be implemented prior to safely resuming operations. Best practices to integrate into operations may include the following:

• Modify maintenance and inspections, as appropriate, but do not disrupt preventive maintenance programs.
• Include test or performance validation runs of all utilities and equipment on a scheduled basis and with time to ensure proper operations.
• Train facility personnel working in all operations to conduct test runs, monitor results, approve, and complete reporting.
• Establish updated procedures for all personnel, contractors, drivers, and approved visitors prior to site/plant entry.
• Establish and implement any new personnel, health, and PPE requirements and work rules (e.g., work area separation, quarantine periods, doctor release notes, closed campus, social distancing).
• Upgrade new controls to meet OSHA bloodborne pathogen, PPE, and respiratory programs.
• Modify employee areas to encourage proper hygiene (e.g., handwashing, hand sanitation, PPE, and waste management).
• Determine new, EPA-approved sanitizers and disinfectants, and use appropriate sanitizers in all areas, including shared surfaces like touchscreen covers and their general location.
• Increase environmental monitoring of all possible sources, including coolers/fans/ducts.
• Base operating conditions on enhanced operational inspections: pre-, during, and post-.

Monitoring and Communicating

Final steps must be taken to ensure the proper implementation of updated programs, plans, and strategies during modified operations or shutdown. Monitoring the updated strategies, actions, and conditions must happen through management team review and all levels of organizational responsibility. In addition, facilities must maintain records for changed operations, corrective actions, and verification activities.

And before the plant can open, any updated site programs must be communicated, and personnel must receive appropriate training to ensure safe food and positive worker welfare.

A wider reaching global supply chain exposes our food—and those companies within the food supply chain—to increased risk. As a result, food companies are operating in an increasingly complex world with changing regulations and requirements that require careful monitoring and review. Like many industries, the global pandemic not only complicates many facets of operations, it has also impacted many regulatory and certification requirements.

The following websites provide excellent resources for companies within the food industry to stay on top of the latest regulatory and certification changes. Our advice? Bookmark these sites, sign up for automated emails, and take advantage of the resources available to companies to help navigate the ongoing changes.

U.S. Department of Agriculture (USDA): Food Safety and Inspection Service (FSIS)

This USDA FSIS Regulations, Directives & Notices site gives users access to the Code of Federal Regulations (CFR)), Federal Register (FR), FSIS Directives, and FSIS Notices. Users can sign up with an email address to receive the latest news from USDA and FSIS. These email updates include recall alerts and FSIS directives and notices. This allows users to be “in the know” instantly and to keep ahead of changing regulations. 

The “AskUSDA” and “AskFSIS” features, located on the USDA FSIS homepage, further allow users to look up common questions or submit any question to USDA or FSIS for answers. These features offer a quick turnaround, with responses provided by specialized USDA/FSIS employees.

• AskFSIS: Find answers or ask questions on inspection-related polices, programs, systems, and procedures.
• AskUSDA: Find answers or ask questions about safe food handling at home or food safety in general.

The USDA’s dedicated COVID-19 site breaks down information by topic area, including food supply chain, to answer frequently asked questions about COVID-19.  

U.S. Food and Drug Administration (FDA)

The FDA’s Food Safety Modernization Act (FSMA) impacts every aspect of the U.S. food system, from farmers to manufacturers to importers. Keeping up with changes to the FSMA rules is vital. Users can sign up for automatic emails from the Center for Food Safety and Applied Nutrition (CFSAN) to receive updates, including regulatory changes and recalls. Users can select settings for what product(s) they would like to receive notifications. 

Users can also research and submit questions related to FSMA to the Technical Assistance Network (TAN). Inquiries are answered by FDA Information Specialists or Subject Matter Experts, based on the complexity of the question. Responses are usually timely, based on the complexity of the question. 

In addition, FDA has a dedicated COVID-19 site. To see the latest COVID-19 information from FDA related to the food industry, select “Food & Beverages” from the drop-down “Topic” menu.

Electronic Code of Federal Regulations (e-CFR)

The e-CRF is a currently updated version of the Code of Federal Regulations (CFR). It allows users to look up all sections of the CFR. CFR is the codification of the general and permanent rules published in the Federal Register by the departments and agencies of the Federal Government produced by the Office of the Federal Register (OFR) and the Government Publishing Office (GPO). 

Regulations.gov

Regulations.gov provides an online resource for users to find, review, and submit comments on federal rules that are open for comment and published in the Federal Register.

Global Food Safety Initiative (GFSI)

The GFSI News & Resources section directs users to articles, publications, videos, and news releases on topics related to GFSI and certification.

Beyond that, as GFSI states on their website, “the pandemic has fundamentally affected the management and assurance of food safety in all retailers and manufacturers, globally. We recognise the COVID-19 outbreak continues to create audit restrictions, which has an impact on the certification status of certain sites.” As such, GFSI has created a COVID-19 site to keep companies abreast of certification requirements in light of changing needs and demands. Users can also enroll to receive the GFSI newsletter to stay updated on the latest updates from GFSI.

For resources related to each of the GFSI-benchmarked standards, users can visit the following sites:

• BRCGS
• FSSC22000
• IFS
• SQF

Managing Requirements

There are many great resources available to stay current on the latest regulatory changes and requirements. However, just knowing the requirements is not enough—companies need to be able to manage them to ensure compliance.

Technology-enabled business solutions can help simplify this task. Compliance efficiency tools and document management systems allow companies to:

• Maintain standards, programs, and regulatory requirements in one place
• Outline a plan for meeting each requirement
• Create alignment and consistency between different standards and requirements
• Update requirements as regulations—or company operations—change
• Provide a compliance calendar and tracking to manage and monitor compliance activities

Technology solutions can be instrumental in establishing or improving a company’s capability to efficiently and effectively manage compliance and business processes.  

Over the past several months, many companies have had to prioritize business activities given restrictions on travel and social distancing guidelines. Despite these restrictions, however, certain compliance activities are still required, including training.

Training is a key component for maintaining ongoing compliance—whether with regulatory requirements, supply chain mandates, or internal policies. While some training can be postponed, putting training on the backburner can have its consequences, ranging from unprepared employees, to noncompliance, to preventable injuries or worse.

Much like with audits, there are alternatives to meeting training requirements and ensuring employees are well-instructed and prepared to do their jobs, even with current government and/or company restrictions. Online and virtual training are not necessarily new options, but their popularity is most certainly on the rise. In-person, online, and virtual training can all provide quality options if you understand your training needs and understand what type of training works best in different scenarios.

Face-to-Face

As we have experienced, sometimes there is no substitute for doing things face-to-face. For certain types of training, in-person is clearly the best alternative for a number of reasons:

• It is designed for people who need to genuinely know the material inside and out and for those who would benefit from a more tailored, interactive learning experience.
• With in-person training, learners are able to ask specific questions and get them answered immediately.
• In-person training provides a focused, immersive learning experience, where attendees can have interaction, discussion, and live input.
• Trainers get to know attendees and can adjust training (e.g., material, learning speed, examples) to the group’s learning style.
• In-person training allows attendees to develop relationships with the trainer and other attendees, which can prove beneficial on future projects.

As many organizations have discovered, particularly lately, while in-person training may offer a great alternative, it is not always possible. Beyond travel and social distancing restrictions, in-person training can also be cost-prohibitive. In addition, scheduling of in-person training can present more challenges, as timing is based on the instructor and is not flexible.

Best suited for: Multi-day classes where demonstration of competency is needed, and participants are building skills they will use frequently; introductory classes where participants need to understand new material.

The Online Option

At the other end of the spectrum, we have online training (not to be confused with virtual, which is discussed below). Online training involves an online module that allows participants to watch and/or listen to a pre-recorded class. Generally speaking, online training works best when individuals already know the material (e.g., refresher training) and is most appropriate when the attendee does not have to be an expert in the subject matter (i.e., awareness level vs. functional expertise).

In addition, online training is generally cheaper since it is not customized and does not require travel or an onsite trainer. It can also be faster and more flexible, as attendees can work at their own pace and have the ability to pick their own schedule.

While there are certain benefits to online training, it is not suitable for all types of training. Because online training does not involve a live instructor, attendees are generally unable to ask questions effectively and there is little opportunity for follow-up input on areas covered. This is no opportunity for hands-on learning and interaction. For example, something like 24-hour HAZWOPER training would be difficult to do as an online course, as a hands-on component is valuable in helping participants demonstrate competency, as required. Finally, because of a potentially diverse audience, online training tends to be generic and not tailored to the specific needs.

Best suited for: Courses where participants have had many, many years of experience and just need refreshers, such as HAZWOPER 8-hour, DOT General Awareness, or RCRA refresher training.

Taking It Virtual

Finally, virtual training provides a bridge between online and in-person training. Like online training, virtual training is done via technology (e.g., Zoom, WebEx); however, it takes place live with instructors engaged in the training as it is occurring. Virtual has many of the same advantages as in-person training since it is being done live. Learners can get more in-depth training and benefit from live interaction, questions, and discussion to help develop specialized expertise. Virtual training works best when travel is limited but students still need to have real-time input from the instructor.

That being said, virtual training cannot completely replace in-person training. With screens, it may be difficult for the trainer to read the crowd and accurately interpret learning needs. Hands-on opportunities become more limited—though not impossible—and require cooperation, coordination, and open-mindedness from all attendees. Finally, technology and logistics are critical for this type of training. A computer with good internet access is critical. If internet connections are slow or sound quality is poor, training can quickly become ineffective.

Best suited for: Refresher training (as with online options), more detailed training that can be customized to the specifics of the class (i.e., site-specific, industry-specific), or training for those with less experience who may need to ask questions.

Consider Learning Styles

People learn very differently. Some people are aural learners and can hear material and develop understanding. Others are visual learners so just reading material on a screen “sticks.” Others are tactile learners and need to participate in physical interaction to understand content. It is important to keep this in mind when choosing the best platform, as well:

• With in-person classes, all learner types can be addressed. 
• With online classes, typically only visual learners retain the information unless there is audible training coordinated with the material. 
• With virtual learning and coordination with the site prior to the training program, all three learner types can be addressed. 

While some training can be rescheduled with minimal impacts to the business, many training requirements cannot. Companies need to know their workers are retaining the information, particularly given OSHA requirements that employees must demonstrate understanding and competency. To ensure that training not only “checks the box” but is also effective, it is important to evaluate not just the training, but the delivery options. In-person, online, and virtual all have their strengths based on the training needs and individual learning styles.

The second annual World Food Safety Day (WFSD) returns on June 7, 2020 under the theme “Food safety, everyone’s business.”

WFSD was originally declared by the United Nations on June 7, 2019, to draw global attention and inspire action to help prevent, detect and manage foodborne risks, contributing to food security, human health, economic prosperity, agriculture, market access, tourism and sustainable development. 

This year’s celebration focuses on food safety being a shared responsibility—from farm to table—including governments, to producers, to consumers.

A wider reaching global supply chain exposes our food and those companies within the food supply chain to increased risk. KTL is committed to supporting companies in our increasingly complex world with effectively operating across the food supply chain, while managing food safety and quality risks.  

Both the U.S. Food and Drug Administration (FDA) and World Health Organization (WHO) offer a number of resources for companies and individuals to participate in World Food Safety Day and help reduce food safety risks.

Audits provide an essential tool for improving and verifying compliance performance. Audits may be used to capture regulatory compliance status, management system conformance, adequacy of internal controls, potential risks, and best practices.

Most regulations, standards, and guidance require audits to be conducted with some established frequency. For many companies, figuring out how to meet these audit requirements amongst travel restrictions, new company safety protocol, and government quarantines related to COVID-19 presents a significant new challenge.

The Online Alternative

Companies come in a variety of sizes with a range of different needs. Because of this, auditing standards remain fairly flexible by design. Fortunately, this allows for online/remote/virtual audits as a viable alternative to onsite audits—provided the audits:

• Are planned well;
• Appropriately leverage technology; and
• Are executed by a team who understands the facility and the requirements.

The ultimate objective of a virtual audit remains the same as an in-person audit: To obtain credible audit evidence to accurately assess compliance/conformance with identified requirements/specifications. The difference lies in the means in which that evidence is collected (i.e., live stream video, surveillance cameras, group web meetings, electronic document review).

Weighing Risks vs. Rewards

Audits can be conducted onsite, remotely, or a combination of the two. In many cases, companies may already be having portions of the audit (e.g., document review) done remotely. Moving the entire audit to the virtual world allows credible evidence to be obtained in unique ways that can offer significant benefits to a company when onsite audits aren’t possible—and even when they are:

• Reduced cost – Online audits eliminate the expenses associated with travel (i.e., mileage, flights, hotels, meals), which can add up depending on the location and duration of the audit.
• Flexible schedule – Remote audits can be conducted on a more flexible time schedule. Auditors do not have to complete work onsite in a set number of days, as is required when traveling to a facility. The auditor can also review areas in question remotely after the audit is technically over. Note that a more flexible time schedule does not necessarily mean less time involved to conduct the audit.
• Social distancing – As CDC guidelines have recommended, it is currently safest to work remotely, when possible, or to remain six feet of social distance to avoid potential transmission of COVID-19. Through the use of technology, virtual audits provide a social distancing extreme.
• Improved systems – Preparing for a virtual audit provides the “push” some organizations need to improve electronic storage systems. To conduct a virtual audit, documents and records must be retained in an organized manner that facilitates easy/quick access. Being able to access all documents remotely is necessary—paper records or documents stored on individual computers/network drives no longer cut it.

At the same time, there are some potential risks to conducting a completely virtual audit, particularly since this practice is relatively new to many organizations:

• Observation/technology limits – Observation of site conditions is limited by the ability to direct live stream video remotely. Technology can create limitations. If the camera can’t see it, neither can the auditor. Poor video quality can impede visual clarity. You don’t know what you don’t know.
• Communication confusion – It can be difficult to read body language and/or interpret emails and phone conversations to make sure communication is clear. This can require revisiting topics/findings several times to ensure accurate evidence is collected.
• Time barriers – There may be time zone and associated scheduling barriers depending on the location of the auditor and the facility.

Considerations and Best Practices

Regardless of the type of audit a facility conducts (i.e., remote, onsite, combination), standard audit best practices should be followed to ensure that audit results are comprehensive and credible. If the company opts for a virtual audit—for any reason—there are a number of considerations and best practices to ensure that the audit effectively fulfills its objectives and alleviates the risks outlined above to the extent possible:

• Site Familiarity – Virtual audits work best if auditors are familiar with the industry and/or operations. While it is not necessary for the auditor to have visited the site before, that type of familiarity with the facility provides the best-case scenario, especially for compliance audits, as it prepares the auditor to know what to look for (and where) and what questions to ask.
• Careful Planning – Much like onsite audits, virtual audits require careful upfront planning on the part of the auditor and the facility—and perhaps to an elevated degree.
  • The facility needs to collect all documents and records prior to the audit and determine best way to present that information remotely (e.g., email/transfer ahead of time, allow access to company Intranet/shared directory space, share during a web meeting).
  • Interviews are best scheduled in advance to ensure availability; however, they can be conducted on an ad hoc basis as need arises.
  • It is best to plot out route and areas of specific focus for the audit ahead of time using a site map as a guide to ensure that all areas are covered and that the audit can be conducted as efficiently as possible using the allocated facility resources. An audit site guide must be assigned who is familiar with the entire facility.
  • Technology needs and requirements must be evaluated, and logistics and access should be tested prior to the audit. It is vital that all cameras, web meetings, shared document space, WiFi, and other technology is working appropriately prior to the audit or a lot of time can be wasted troubleshooting issues.
• Video – Videos should be live. Site walks should be led by a site guide/employee along the planned route with smart phones, iPads, etc., with live streaming capabilities. It is important to ensure that live streaming works within the facility being audited so auditors have a clear view of site conditions. Auditors can also take advantage of any in-house surveillance cameras (e.g., security or quality systems) to provide additional footage of operations, when necessary. In most cases, surveillance footage cannot replace live video.
• Web Meetings – Opening, closing, and daily briefings can be conducted via web meeting. Remote audits provide the flexibility to conduct the audit in segments, with briefings following each segment. This allows the auditor to review video footage, evaluate records, and generate questions to ensure the information collected is accurate and complete.

Companies all over the world are working through a transition period right now, where they are trying to establish what a new “normal” looks like when it comes to operating practices, employee health and safety, business continuity, and compliance. Audits are one piece of the overall puzzle that can be transitioned somewhat seamlessly with the right planning and technology in place to ensure ongoing compliance.

The following information outlines provisions the GFSI-benchmarked schemes are taking to account for audit disruptions due to COVID-19, as of April 21, 2020.

FSSC 22000

www.fssc22000.com

Re-Certification Audits (V5 upgrade audits)

• A risk assessment will be completed.
• The decision from the risk assessment could lead to extension to the current V4.1 Certificate of up to 6 months.
• The full V5 re-certification audit will need to take place within 6 months.
• The new V5 certificate will have dates aligned with the current certification cycle.

Surveillance Audits (V5 upgrade audits)

• A risk assessment will be completed.
• The decision from the risk assessment could lead to:
  • Maintaining the current V4.1 Certificate
  • Suspending the V4.1 Certificate
  • Postponement of the surveillance/periodical V5 upgrade audit by a maximum of 6 months.

BRC GS

www.brcgs.com

Recertification Audit

Where the site is operational, but a physical audit cannot occur on or before the due date and will result in an existing certificate expiring, a certificate extension of up to 6 months validity may be issued based on:

• The successful completion of a risk assessment by the certification body confirming it is appropriate to continue certification.
• The certification body completing a discussion with the site and review of procedures in place to establish the impact of COVID-19 extraordinary circumstances to the site operations and the effective implementation of an emergency response plan.
  • Certifications can only be extended by the current certification body.
  • Sites with C & D grades may not be extended.
  • For BRCGS Packaging, any extended certificates will be against Version 5.

IFS

www.ifs-certification.com

IFS is subject to the decisions of local authorities and cannot provide a general statement (each situation need to be assessed individually). In the case that an audit cannot be performed on time:

• This will result in the certificate not being renewed.
• An exceptional extension of the existing IFS Certificates is not possible.

Due to precautions taken by local authorities, it may not be possible to carry out audits. In this case, existing IFS certificates remain valid until the end of their term and then lose their regular validity.

IFS appeals to retailers and their suppliers to contact and find bilateral solutions so that supplier contracts can be maintained. The IFS will make it visible in the database if IFS certificates could not be renewed due to COVID-19.

SQF

www.sqfi.com

A certifying body can request to SQF for a site to have a one-time 6-month extension from the certificate expiration date.

• Request may not occur until site is within the audit window of the audit.
• Certifying body will conduct a risk assessment to understand and determine if there is a need to extend the certificate following the IAF Informative Document for Management of Extraordinary Events or Circumstances Affecting ABs, CABs, and Certified Organizations (IAF ID 3:2001).
• Certifying body will submit a change request and Notification Form to SQF for approval.
• Requests will be considered by the SQF Compliance Manager in consultation with the technical team and applicable certifying body and/or legal counsel.
• If the risk assessment identified a low risk of continued certification for a site, SQF will approve and certifying body will extend the expiration date for 6 months from the recertification date.
• Sites that are in the process of switching to a new certifying body, the certifying body that holds the current site’s certificate will be required to conduct the risk assessment to determine the risk level to the existing certificate.
• Unannounced audits can be waived up to 5/31/2020. Any waived must be conducted in 2021.

KTL will continue to track these changes and their impacts on the food industry. We hope KTL can be a trusted resource on many levels now and as we eventually return to “business as usual”.

At the most basic level, a root cause is the fundamental reason—or the highest-level cause—for the occurrence of a problem, incident, or event. The root cause sets in motion the entire cause-and-effect reaction that ultimately leads to the problem. Getting to the root cause of any problem is important not just for resolving the issue at hand, but for identifying underlying issues to ensure that similar problems do not occur in the future. This starts with a process called the root cause analysis (RCA).

What Is the Root Cause Analysis (RCA)?

A root cause can be permanently eliminated through process improvement. RCA is a method of problem-solving used to identify the underlying (i.e., root) cause(s) of a problem/incident. RCA can be used to solve problems and provide preventive actions for:

• Major accidents
• Everyday incidents
• Minor near misses
• Human errors
• Maintenance problems
• Medical mistakes
• Productivity issues
• Manufacturing mistakes
• Environmental releases
• Risk analysis, risk mapping

RCA is a systematic process based on the basic idea that effective management requires more than merely putting out fires. RCA focuses on finding a way to prevent these fires from recurring. Rather than just treating symptoms, RCA seeks to identify and address the true, underlying concerns that contribute to a problem or event.

Why is this important? If you just treat the symptoms of the problem, that alleviates them for the short term, but it does nothing to prevent the problem from coming back again. Lasting solutions address the underlying factors—the root cause(s)— that create the problem in the first place. Targeting corrective measures at the identified root causes, subsequently, is the best way to alleviate risk and ensure that similar problems do not occur in the future.

Best Practice

Both the Occupational Safety and Health Administration (OSHA) and Environmental Protection Agency (EPA) encourage organizations to conduct RCA following an incident or near miss at a facility. In fact, facilities covered by OSHA’s Process Safety Management (PSM) standard are required to investigate incidents that resulted in (or could have reasonably resulted in) a catastrophic release of highly hazardous chemicals. Similarly, EPA’s Risk Management Program (RMP) regulations require regulated facilities to conduct incident investigations. In addition, certain management systems, including ISO and Responsible Distribution (National Association of Chemical Distributors) to name just a few, also require RCA.

Whether an organization is subject to PSM, RMP, or management system standards, identifying the root cause of any incident or problem through RCA is a best practice that can significantly benefit organizations by identifying underlying issues to ensure that similar problems do not occur in the future. So, how do you effectively implement RCA?

Six-Step Process

RCA can be broken down into a simple six-step process, as outlined below.

Step 1: Identify and Clearly Describe the Problem

The first step is to understand and document the problem/issue/incident that actually occurred. This might involve interviewing key staff, reviewing security footage, investigating the site, etc. to get an accurate account of the issue. Certainly safety- or security-related incidents might require an immediate fix or prompt action before the carrying out the complete RCA. This is always the first priority.

Some problems are easier to define than others based on what happened and the extent of the issue. When defining and describing the problem, it is important to be as descriptive as possible, as this will aid in future steps to identify the root cause(s).

For example, the first description below is somewhat vague. The second description provides an additional level of detail that more fully documents the situation:

1. A forklift driver wasn’t wearing his seatbelt. (vague)
2. During a walkthrough of the warehouse on 2/1/20, it was observed that forklift driver John Smith, who is a contract employee, was not wearing his seatbelt while operating the forklift. (clear)

Step 2: Identify Possible Causes…Why?

There are several methods for identifying possible root causes. One of the most common is known as the “5 Why Method”. This approach simply involves asking the question “Why” enough times (i.e., five times) until you get past all the symptoms of a problem and down to the underlying root cause of the issue. The detailed problem description put together during Step 1 serves as the starting point for asking “Why”.

Let’s take our problem description from above a step further to identify the possible causes using the 5 Why Method.

Step 3: Identify Root Cause(s)

At this point, the 5 Why Method is leading you to the core issue that set in motion the entire cause-and-effect reaction and, ultimately, that led to the identified problem(s). It’s now time to determine whether the five whys have dug deep enough. Where does your questioning lead you? Is there one root cause or are there a series of root causes contributing to this incident? Often, there are multiple root causes that may be factors to address when preventing future incidents.

In our forklift operator case, the 5 Why Method points to the lack of a standardized checklist of all items to be trained on—including forklift training—prior to a new contract employee coming onsite.

Step 4: Corrective and/or Preventive Action Taken

Based on the identified root causes, it then becomes possible for the facility to determine what corrective and/or prevention actions (CAPAs) can be taken to fix the problem and, just as important, prevent it from occurring in the future. For our example, there are a number of potential CAPAs:

• Stop the employee from operating the forklift and educate him on seatbelt policy prior to resuming work
• Review contract/temp employee training program
• Retrain shift managers on training expectations
• Obtain training records for contract/temp employees
• Provide refresher/retraining, as necessary
• Add signage to forklifts and warehouse bulletin boards about seatbelt policy

Step 5: Analyze Effectiveness

The effectiveness of whatever action is taken in step 4 needs to be evaluated to determine whether it will resolve the root cause. If not, another CAPA should be explored, implemented, and analyzed to assess its impact on the issue/problem. If it is a root cause, it should help to resolve the issue and you should move on to step 6 below.

Let’s return to our example. You might ask, “Was the retraining effective?” An evaluation shows the following:

• Yes, the employee continues to operate the forklift using seatbelt.
• Yes, subsequent walkthroughs of the warehouse over the next six months have not resulted in any additional seatbelt violations.
• The next contract/temp employee brought on to assist during the busy end-of-year season was required to produce current training.

Step 6: Update Procedures, as necessary

As CAPAs are implemented, once they prove effective, related policies and procedures must be updated to reflect any changes made. This step ensures the outcomes of the RCA will be integrated into operations and used to prevent similar incidents from happening in the future.

In our current example, this might mean that the Contractor Policy is updated to include a new section specific to the hiring of contract/temp employees with the following requirements:

• Obtain valid training certificates for work performed
• Ensure Managers conduct on-the-job training for contract/temp employees specific to work performed

Benefits of RCA

Following these six steps will help to ensure a thorough investigation that identifies the root cause(s) versus just symptoms is conducted. It further ensures that any changes related to the root cause are integrated into the organization to prevent similar events from happening again. In the end, the RCA process can help:

• Reduce the risk of injury and/or death to workers and community members
• Reduce the potential for environmental damage
• Avoid unnecessary costs resulting from business interruption; emergency response and cleanup; increased regulation, audits, and inspections; and OSHA or EPA fines
• Improve public trust by maintaining an incident-free record
• More effectively control hazards, improve process reliability, increase revenues, decrease production costs, lower maintenance costs, and lower insurance premiums

KTL recently announced our partnership with Martin Mantz Compliance Solutions (Martin Mantz), developer of the GEORG Compliance Management System® software. KTL is providing regulatory compliance expertise to the German-based company as it expands its offerings to clients with operations in the United States.

In this recent article, our partners at Martin Mantz discuss how Rudolph Logistics Group, an international logistics service provider from Germany, is using GEORG as a compliance solution to provide employees clear information in accordance with ISO standards on:

• Tasks – what they have to do
• Responsibilities for implementation – who needs to do it
• Date/time of completion – when it needs to be done
• Description of the way the task is to be performed – how the task must be fulfilled

The objective is to simplify requirements to the extent possible so employees can focus on tasks to be completed without needing to interpret complicated and extensive guidelines. Read more…

KTL is pleased to announce our partnership with Martin Mantz Compliance Solutions (Martin Mantz), developer of the GEORG Compliance Management System® software. KTL is providing regulatory compliance expertise to the German-based company as it expands its offerings to clients with operations in the United States.

“Martin Mantz has created something unique with the GEORG software in that it simplifies and provides an interpretation of legal and technical requirements in a customer-specific database,” KTL Principal Lisa Langdon states. “KTL’s understanding of industrial operations, as well as U.S. legal and technical requirements (e.g., EPA, OSHA, FDA, ISO), allows us to translate these requirements into simple tasks in the GEORG system that employees can follow to help fulfill regulatory requirements.”

How GEORG Works

GEORG is used to make the requirements of standards and regulations comprehensible and transparent. KTL specializes in the practical mapping of legal requirements and audits. These audits allow KTL to create technical content for the GEORG system based on facility-specific applicability. We then work directly with the company to delegate the identified tasks. If there are revisions in the standards/regulations, KTL works in the system to ensure tasks are updated to meet regulatory requirements.

The benefits of this approach include:

• Effectiveness – All tasks are assigned, easily formulated, and regularly updated.
• Efficiency – The effort and expertise required to understand complicated regulations is reduced.
• Transparency – Responsibilities are clear and easily visible to all employees.
• Conformity – Compliance status within the system reflects the degree of fulfilment of the related requirements.

Faber-Castell Expands GEORG Implementation to U.S. Subsidiary

Faber-Castell Cosmetics, an internationally renowned Martin Mantz customer with worldwide operations, is already benefitting from the Martin Mantz-KTL partnership. After successful implementation of the GEORG software in their German facilities, Martin Mantz has worked with KTL to expand usage to Faber-Castell’s subsidiary in the U.S.

About Martin Mantz Compliance Solutions
Martin Mantz Compliance Solutions, based in Grosswallstadt and Leipzig, Germany, offers its contractual partners services in the area of ​​legal organization (GEORG) of companies to avoid organizational negligence and compliance violations. This includes consulting and provision of the compliance software GEORG Compliance Management System®, implementation of the technical and legal modules, as well as construction and maintenance of the customer-specific database. https://www.martin-mantz.de/

About Kestrel Tellevate LLC
KTL is a multidisciplinary consulting firm that specializes in providing environmental, health, and safety (EHS) and food safety management and compliance consulting services to private and government clients. Our primary focus is to build strong, long-term client partnerships and provide tailored solutions to address regulatory requirements. KTL’s services include management system development and implementation, auditing and assessments, regulatory compliance assistance, information management solutions, and training. KTL is a Small Business Administration-registered company with headquarters in Madison, WI and Atlanta, GA and offices across the Midwest and Washington, D.C. www.kestreltellevate.com