Webinar FSSC 22000 audit report 7th september 2015

Mission FSSC 22000 “To be the world’s leading, independent, GFSI recognized, ISO based food safety and quality management system for the entire food supply chain.”

Today’s topics Basics audit reporting Definition audit report Audit report requirements Audit findings Audit report modules (template) Conclusions

1. Basics audit reporting

Starting point – Basic questions Where does the audit report fit in the accredited certification process? Who is the audit report written for? How important is the audit report? What decisions are derived from the audit report? Who prepares the audit report? Looking for an understanding that the audit report is the key to effective certification Ian’s key points (hoping they emerge) The audit report is the audit = no such thing as an audit without a report. Auditors do not make the decision to issue a certificate or to leave one in place (from an SV). Those using the scheme should be able to us audit report in their supplier assessment systems Giving any kind of advice in an audit report is the lowest priority A CB has no role in the development of systems.

Audit report basics The audit report is prepared by the auditor. The audit report is a written record of the audit. The FSSC report, shall give confidence that the certified organization has all basic FSMS conditions and PRP’s well managed and fulfilled. The audit report shall provide an accurate, concise and clear record of the audit to enable an informed certification decision to be made by the certification body.

Audit report basics The audit report shall include sufficient detail to ensure that it clearly expresses where the processes of the audited site are in compliance, or not in compliance, with the scheme’s standard requirement. In case where non-conformity is identified by the auditor, clear and concise detail of the non-conformity shall provided in the audit report.

2. Definition audit report

Audit report definition The audit report is a transparent and to the point reflection of the findings of the auditor during the audit and shows clear evidence that all requirements are assessed and audited. In the first place the fundamentals for defining how the FSMS works and what the company needs for its processes, and in the second place the verification that the FSMS works in practice.

Enter Manufactures Reference documents ISO 22003:2013, clause 9.1.8 ISO 17021:2011, section 9.1.10 ISO 19011:2011, section 6.5 GFSI guidance document Part II, section 3.6 FSSC 22000 scheme document part II, Appendix II A1, section 7

3. Audit report requirements

FSSC audit report requirements Enter Manufactures FSSC audit report requirements Name and description of the organization Details of previous audit Details of existing certificates Details of relevant changes Details of complaints on food safety List of key personnel present at the audit Evidence that the client has seen and accepted the report Audit of the PRP requirements Results and conclusions Overview of non-conformities

FSSC audit report requirements Enter Manufactures FSSC audit report requirements The audit report shall cover all elements described in the format as indicated in FSSC scheme document Part II, Appendix IIB, in order to confirm that all requirements are assessed and reported. All elements of ISO 22000, PRP standards and additional FSSC requirements.

FSSC audit report requirements Enter Manufactures FSSC audit report requirements In the result sections of the audit report conformance of compliance or non-compliance for each clause shall be indicated. In the summary section positive evidence of confirming compliance for each section shall be provided. In case of non-conformance detail shall be provided. Non-applicable clauses shall be motivated.

Required documentation Auditee acceptance of findings and non-conformities Audit working document (raw data) Attendance sheet for audits FSMS documentation review Non-conformity report Audit final report Audit plan and/or final audit program Description of main elements of the FSMS and their interaction

Food Safety Management System FSSC 22000 is about the certification of a management system. The report must show that the system (processes) are audited against the scheme requirements. Main system areas are: Management Personnel Premises and facilities Purchasing Production Laboratory facilities Packing and dispatch Products

Audit worksheet version - with example audit areas in columns A-H   Basic traceability details in this box Audit area, (product, process, site) Management Personnel Premises & Facilities Purchasing Production Test Lab Packing & Despatch Products Clause Title (ISO 22000) A B C D E F G H 4 Food Safety Management System 4.1 General requirements 4.2 Documentation requirements 5 Management responsibility 5.1 Management commitment 5.2 Food safety policy 5.3 Food safety management system planning Example….matrices like these should ne mandatory for all schemes…

The report shall also contain A statement of the conformity and the effictiveness of the management system together with a summary of evidence relating to: The capability of the MS to meet the aplicable requirements and expected outcomes The internal audit and management review proces A conclusion of appropiateness of the certifiction scope Confirmation that the audit objectives have been fulfilled Looking for an understanding that the evidence in the audit report must be sufficient to justify the certification decision Ian’s key points (hoping they emerge) Audit report must match the system scope in terms of audit areas (ISO 22k/4.1 second para) The Audit Report template is the work sheet (work-instruction) designed by the CB to ensure audits are done their way. Allowing auditors a free hand to audit how they like is consulting by definition. Min evidence includes for each audit area, Names of participants, Activities covered, Evidence seen, Good points, Bad points (NCs), A matrix of standard coverage vs audit area is mandatory for control purposes Certification Managers (not auditors) make the decision to issue a certificate or to leave one in place (from an SV). Those using the scheme should be able to use audit report in their supplier assessment systems Giving any kind of advice in an audit report is the lowest priority A CB has no role in the development of systems.

Minimum information required What information MUST be included in the report? Stage 1 (documentation review; Readiness) Stage 2 (certification audit; Effectiveness) Surveillance (maintain confidence) Re-certification (Effectiveness, Commitment, Achievement of objectives) Looking for an understanding that the evidence in the audit report must be sufficient to justify the certification decision Ian’s key points (hoping they emerge) Audit report must match the system scope in terms of audit areas (ISO 22k/4.1 second para) The Audit Report template is the work sheet (work-instruction) designed by the CB to ensure audits are done their way. Allowing auditors a free hand to audit how they like is consulting by definition. Min evidence includes for each audit area, Names of participants, Activities covered, Evidence seen, Good points, Bad points (NCs), A matrix of standard coverage vs audit area is mandatory for control purposes Certification Managers (not auditors) make the decision to issue a certificate or to leave one in place (from an SV). Those using the scheme should be able to use audit report in their supplier assessment systems Giving any kind of advice in an audit report is the lowest priority A CB has no role in the development of systems.

4. Audit findings

Audit findings OFI Area of concern Major non-conformity Minor non-conformity

Opportunity for improvement (OFI) The auditor may identify opportunities for improvement during the audit. Not an issue of non-compliance to a specific requirement but an observation by the auditor that will help the organization to improve. Substantiated by objective evidence. No corrective actions are required.

Area of concern A finding raised during the stage 1 audit that could be classified as a non-conformity during the stage 2 audit. Substantiated by objective evidence. Corrective actions are required. Will be assessed during the stage 2 audit.

Minor non-conformity Non-conformity that does not affect the capability of the management system to achieve the intended results. Substantiated by objective evidence. Clear and concise detail of the minor non- conformity shall provided in the audit report.

Major non-conformity Non-conformity that affects the capability of the management system to achieve its intended results Significant doubt that effective process control is in place or that products or services will meet specified requirements A number of minor non-conformities associated with the same requirement or issue could demonstrate a systemic failure and thus constitute a major non-conformity Substantiated by objective evidence. Clear and concise detail of the major non-conformity shall provided in the audit report.

Corrective actions The certification body shall require the client to analyze and describe the specific correction or corrective actions taken, or planned to be taken, to eliminate detected non- conformities, within a defined time. The certification body shall review the corrections, identified causes and corrective actions submitted by the client to determine if these are acceptable. the certification body shall verify the effectiveness of any corrections or corrective actions taken. The evidence obtained to support resolution of non- conformities shall be recorded. If necessary a additional on-site audit to verify effectiveness.

5. Audit report modules - Template

Audit report modules

Audit report modules

Audit report modules

Audit report modules

Audit report modules

Audit report modules

Audit report modules

Audit report modules

Audit report modules

Audit report modules

6. Conclusions

Conclusion Auditors do not issue certificates. The audit report shall provide an accurate, concise and clear record of the audit to enable an informed certification decision to be made by the certification body.

Take a ways The auditor is out there doing his job. We all depend on the professional judgement of the auditor. The auditor needs support to perform the audit and to draft the audit report. The auditor does not issue certificates.

Keep in touch E-mail info@fssc22000.com Phone (+31) 183 645 028 www.fssc22000.com Join us at LinkedIn: Group FSSC 22000 Follow us on Twitter: @FSSC22000