BSI food safety audits during the Coronavirus pandemic (COVID-19)

For operational sites where physical audits can’t take place and not conducting an audit will lead to a certificate expiring, with approval from BSI scheme management, the site’s certificate will be extended for six months. Extensions will be approved by BSI’s BRCGS programme manager and based on documented eight-hour risk assessments which will cover:

1. Certification history
2. The site’s COVID-19 emergency response plan
3. Internal audits
4. Significant changes
5. Customer complaints, recalls and withdrawals
6. Management meetings

Non-conformities can still be raised and shall be actioned by the site as per the standard BRCGS close-out timeframe.

Once the site becomes accessible, the full onsite audit will need to take place as normal

BRCGS Packaging: If your site is certified to Issue 5, the risk assessment will be conducted against Issue 5. When travel restrictions are lifted, a full on-site Issue 6 audit must be conducted as soon as possible.

BRCGS Gluten Free: If your site uses a third-party programme that allows remote audits to underpin the GFCP, the third-party’s remote audit principle can be used.

Unannounced audits: All unannounced audits are suspended and will occur as announced audits.

New or transfer clients: BSI can’t accept new or transferring clients without a physical site visit. Therefore, clients in the process of transferring must return to their original certification body.

Depending on where you are in the certification or audit cycle, BSI is applying different techniques to site located in places where travel and/or access is restricted.

Certification audits: depending on circumstances certification audits will either be postponed by up to six months or take place using remote auditing technology. To qualify for a remote audit your organization will have to show BSI, in advance that your site has the technological capability to support remote audits.

Recertification audits: if a risk assessment shows a low level of risk associated with using remote audit technology this is how your audit will be conducted. An on-site will still be required when the travel and/or access restrictions are lifted. If the risk assessment results don't suggest that remote auditing is appropriate, your certificate may be extended for up to six months depending on the circumstances.

Certification audits: depending on circumstances certification audits will either be postponed by up to six months or take place using remote auditing technology. To qualify for a remote audit your organization will have to show BSI, in advance that your site has the technological capability to support remote audits.

Surveillance audits: if a risk assessment shows a low level of risk associated with using remote audit technology this is how your audit will be conducted. An on-site will still be required when the travel and/or access restrictions are lifted. If the risk assessment results don’t suggest that remote auditing is appropriate, your certificate may be extended for up to six months depending on the circumstances.

Recertification audits: if a risk assessment shows a low level of risk associated with using remote audit technology this is how your audit will be conducted. An on-site will still be required when the travel and/or access restrictions are lifted. If the risk assessment results don’t suggest that remote auditing is appropriate, your certificate may be extended for up to six months depending on the circumstances.

If your Costco audit is normally done using a Costco addendum to a GFSI standard, if that GFSI permits remote audits, your Costco Addendum annual recertification audit will be delivered remotely. How each GFSI programme owner is managing travel restrictions varies, but currently they include certificate extension periods, remote audits and audit postponements.

If your business is not audited using a GFSI programme addendum i.e. small supplier audit or unannounced GMP annual recertification, your audit will receive a three-month postponement. The unannounced GMP audits will be performed as announced audits.

If your business has put a No Visitation Policy in place, on one email you are required to send your policy to FSA@costco.com and foodglobal.admin@bsigroup.com to be considered for a three-month postponement of your audit.

If your business has temporarily closed, your audit can be postponed but you are required to raise this in an email addressed to FSA@costco.com and your local country BSI Customer Service Officer. You also have to include the date you expect to start production again.

For operational sites where, physical audits can’t take place the course of action to be taken will be based on a risk assessment. The risk assessment will determine if the certified site has developed/adjusted its procedures and operations to ensure continued compliance to the FSSC Scheme and the supply of safe products.

The documented risk assessment will review:

• The history of the FSSC food safety management system
• Any pending compliance activities or legal proceedings
• Your organization’s current and expected future situation as per IAF ID3:2011
  • Emergency preparedness and response including the impact of the COVID-19, including changes to processes or services outsourced following the COVID-19 epidemic
• Key changes since the last audit
• Performance evaluation:
  • Status of your FSMS objectives
  • Status of the key process performance including, but not limited to, the monitoring and corrective actions of OPRPs and CCPs
  • Management review
  • Internal audits: throughout the pandemic it’s expected that certified organizations increase the frequency of internal audits in support of the FSMS and to ensure food safety
• Customer complaints as well as product recalls and withdrawals

Low-risk outcomes will result in one of the following three options:

• Your certificate is maintained
• Your certificate is maintained  and the surveillance audit is postponed for a period not exceeding six months.
• Your certificate will be extended for a period not exceeding six months, a full recertification audit will take place on site before the extension date expires.

The opportunity for twelve-month extensions to GlobalG.A.P. certifications are already part of the GLOBALG.A.P. system. To help offset travel and/or access challenges presented by COVID-19, this may be extended by six months using a risk assessment.

There are some circumstances where this extension can't be used, including if:

1. Your site currently isn't producing product and within the extension period you don't expect to sell any product and the next expected harvest won't start before the end of the six-month extension.
2. You haven't confirmed to BSI that your site will continue with the certification after the extension.
3. Your site has a complaint against it that must be investigated on-site.

Corrective actions: if you can provide proof that presenting corrective actions isn't possible within the normal 28-day period, an additional 28-day extension may be granted.

How ISO 22000 audits are managed depends on which type of audit is scheduled.

Stage 1 audits will be conducted remotely within six months of the stage one audit.

Stage 2 audits must be conducted within six months of the Stage 1 audit.

Surveillance audits will be conducted remotely whenever possible. If a remote audit isn’t possible, and extension of up to 6 months from the planned audit date may be granted. To be considered for the postponement, a BSI-led risk assessment that results in a low risk rating must be completed.

Recertification audits  will be conducted remotely whenever possible. If a remote audit isn’t possible, extensions of up to 6 months from the planned audit may be granted. To be considered for the postponement, a remote interview and/or BSI risk assessment that doesn’t identify any major issues is required. This activity does not replace the actual audit which will still take place after the postponement.

McDonald’s is offering various solutions across their supplier audit programme.

SQMS If your SQMS audit is normally delivered using an SQMS addendum to a GFSI standard, if that GFSI permits remote audits, your SQMS audit will be done remotely. If your business is not audited using a GFSI programme addendum and a physical on-site audit cannot occur, your audit can or may be postponed for 90 days. Please note, the 90-day period will be re-evaluated as the pandemic evolves.

DQMP and GAP audits have been postponed for 90 days. Please note, the 90-day period will be re-evaluated as the pandemic evolves.

Unannounced Category 1 GMP audits will be performed as announced audits.

New suppliers in the onboarding process with McDonald’s are still being asked to meet the usual onboarding requirements at this time.

How travel and/or access issues are managed for RSPO P&C sites depends on what stage you are at in certifying your site.

Initial audits: are postponed until travel and/or access restrictions and on-site audits can take place.

Surveillance and Recertification audits: can be postponed for up to six months. The six-month total is made up of the regular three-month license extension plus an additional three months. To qualify for the additional three months, a remote audit is required. The remote audit does not replace your on-site audit, it only postpones it by the total six-month period.

RSPO remote audits:

• Will not be used where and when on-site audits are possible
• Can only take place after the regular three-month extension has passed, but must take place before the end of the extended three-month period
• Will focus on:

1. The list of RSPO P&C indicators identified by the RSPO Secretariat that can be audited remotely and any major non-conformity must be closed within the timeframes included in the RSPO P&C 2018 or before the license extension submission is made (if this does not happen, the certificate will be suspended until an on-site audit can take place)
2. Assessing the documentation to support the status of any pending non-conformities from your previous audit.

If a travel ban is in place that impacts your site, RSPO is currently allowing remote audits for initial certification, surveillance and recertification audits. When conducting remote audits, documentation review (including the purchase and sales of certified material) will be carried out according to RSPO Supply Chain Standard requirements. PalmTrace management, including License Extension, will be carried out according to the current practice.

BSI can submit a formal request to SQF asking for change of up to six months is made to your audit date. To support our request to SQF, we must include a documented risk assessment conducted by an SQF-qualified auditor.

To determine if an extension can be granted, a one to four-hour risk assessment must find no non-conformances and that:

• All comments to the criteria assessed are suitable
• Procedures are in place to establish the impact of COVID-19 extraordinary circumstances
• The emergency response plan has been effectively implemented
• It's appropriate to continue your site's certification

If the assessment identifies that your site doesn’t meet this criteria, further remote activity will be required.

Unannounced audits: Through 30 May 2020, sites in the third (last) year of their audit cycle will have their unannounced audit waived. Sites may have the option to have an announced audit in 2020 and have the mandatory unannounced audit in.

Surveillance audits
Option one: A risk assessment is conducted and, with a low-risk result, your site’s certificate can be extended for three months.

Option two: A risk assessment is conducted and, with a low-risk result, a remote surveillance audit can take place. No additional audits will be required until your site’s recertification audit.

Woolworths is updating their processes on a regular basis.

The information here only applies to the following WSE audit types: WSE Food Manufacturing Standard, Industry Standards (Egg Grading Floors and Meat – Retail Ready Packing Operations, Feedlot cattle Australia, Service providers), Woolworths Liquor, Woolworths Produce Standard, HARPS, WSE Consumer Goods Program and Woolworths Ethical.

If your WSE audit is scheduled between now and 30 June 2020, the following applies to your site.

If there are no restrictions in place to prevent a BSI auditor from visiting, your audit will take place on-site as planned.

If there are restrictions in place that prevent an onsite audit:

1. A remote audit may be possible and if approved by Woolworths, BSI will arrange this with your organization.
2. If a remote audit is not possible, a Woolworth’s Quality Specialist (WQS) will complete a risk assessment according to the appropriate option below (a, b, c or d)

a) Annual audit frequency, GFSI base (either accepted or not accepted by Woolworths)
The relevant WQS will risk assess your site’s previous audit history as well as it’s complaints and recall/withdrawal trends. Sites with successful reviews will have a six-month extension applied. If your review is unsuccessful a WQS will contact you to outline audit requirements, which may require a remote audit to be conducted.

b) Biannual audit frequency, GFSI base (either accepted or not accepted by Woolworths)
The relevant WQS will risk assess your site’s previous audit history as well as it’s complaints and recall/withdrawal trends. Sites with successful reviews will have a three or six-month extension applied. The length of your extension will be determined by the quality of your performance. If your review is unsuccessful a WQS will contact you to outline audit requirements, which may require a remote audit to be conducted.

c) Woolworths Supplier Excellence base (standalone) and Harmonised Australian Retailer Produce Scheme (HARPS)
The relevant WQS will risk assess your site’s previous audit history as well as it’s complaints and recall/withdrawal trends. Depending on the results of the review, your will either have to undergo an on-site or remote audit or your certificate will be extended for a three or six-month period.

d) Woolworths FoodCo. Asia WSE
If your organization is a FoodCo. Asia (FCA) site, FCA is managing each supplier on a case-by-case basis, granting extension approval accordingly.