CFSQA cheat sheet

Audit definition (ISO 19011): systematic, independent, documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.

Audit types: first-party (internal), second-party (supplier/customer), third-party (certification/regulatory). Each has different independence and reporting lines.

Audit principles (ISO 19011): integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach.

Independence: auditors must not audit their own work. A conflict of interest exists if the auditor has operational responsibility for the area audited within the past 12 months (typical rule).

Audit criteria: set of policies, procedures, standards, regulations, or requirements used as a reference against which objective evidence is compared.

Objective evidence: verifiable data, records, statements of fact, or other information that can be proven true. Opinions and hearsay are not objective evidence.

Audit scope: extent and boundaries of an audit (locations, processes, time period). Audit criteria and scope must be agreed with the auditee before the audit.

Ethical requirements: confidentiality of audit information, no acceptance of gifts that could influence judgment, accurate and truthful reporting, disclosure of conflicts of interest.

Audit program: set of one or more audits planned for a specific time frame and directed towards a specific purpose. Managed by an audit program manager.

Risk-based planning: prioritize audit frequency, duration, and resources based on risk (product risk, process complexity, past performance, regulatory history).

Audit plan contents: audit objectives, scope, criteria, dates, locations, audit team, schedule of activities, and allocation of resources.

Auditor competence: education, training, skills, experience, and personal attributes. Verify competence before assigning audit tasks.

Document review before audit: review manuals, HACCP plans, prerequisite programs, previous audit reports, and corrective action records to focus on-site time.

Opening meeting: confirm scope, criteria, schedule, communication channels, and safety/security arrangements. Document attendance.

Sampling plan for audit program: select a representative number of sites, shifts, products, and processes; justify sample size and selection method.

Audit program records: maintain records of audit plans, reports, nonconformities, corrective actions, and auditor competence for traceability and continual improvement.

Evidence hierarchy: records and direct observation > interviews > hearsay. Corroborate interview statements with records or observation.

Interview technique: ask open questions first, then probing questions; avoid leading questions. Confirm understanding by summarizing back to the interviewee.

Sampling methods: random, systematic, stratified, and judgmental. For audit sampling, document the population, sample size, and selection method.

Sample size rule of thumb: for attribute sampling, a sample of 30–60 items often provides reasonable confidence for presence/absence of a condition; justify deviations.

Nonconformity classification: major (systemic failure, absence of control, food safety risk), minor (isolated lapse, documentation gap), observation (opportunity for improvement).

Traceability exercise: select a finished product lot and trace forward to distribution and backward to raw materials; verify mass balance and records.

Audit trail: record time, location, interviewee, documents reviewed, and observations for each finding to support the report.

Evidence must be sufficient (enough), relevant (related to criteria), and reliable (accurate and verifiable).

Hazard categories: biological (pathogens, toxins), chemical (allergens, pesticides, cleaning chemicals, mycotoxins), physical (metal, glass, plastic, bone), and radiological.

HACCP seven principles: hazard analysis, determine CCPs, establish critical limits, monitoring, corrective actions, verification, record keeping.

Critical control point (CCP): a step where control can be applied and is essential to prevent, eliminate, or reduce a food safety hazard to an acceptable level.

Critical limit: measurable value that separates acceptability from unacceptability at a CCP (e.g., 72°C for 15 seconds, pH ≤ 4.6, water activity ≤ 0.85).

Preventive controls (FSMA): process controls, allergen controls, sanitation controls, supply-chain controls, recall plan, and other controls as needed.

Monitoring: planned sequence of observations or measurements to assess whether a CCP is under control; must be recorded and timely.

Verification vs. validation: validation confirms the control measure can achieve the intended effect; verification confirms ongoing compliance (calibration, record review, product testing).

Allergen cross-contact controls: dedicated lines, scheduling, cleaning validation, label review, and storage segregation.

Prerequisite programs (PRPs): basic environmental and operational conditions needed for food safety (facilities, pest control, cleaning, personal hygiene, water quality, waste management).

Sanitation Standard Operating Procedures (SSOPs): written procedures for cleaning and sanitizing food-contact surfaces, equipment, and environment; include frequency, chemicals, concentration, and responsible person.

Clean vs. sanitize: cleaning removes soil; sanitizing reduces microorganisms to safe levels. Sanitizer efficacy depends on concentration, contact time, temperature, and pH.

Environmental monitoring program (EMP): sampling of food-contact and non-food-contact surfaces for indicator organisms (e.g., Listeria spp., Salmonella) and hygiene indicators (e.g., ATP, coliforms).

Pest control: documented program with bait stations, traps, exclusion, monitoring, and corrective actions for activity.

Water quality: potable water must meet drinking water standards; verify backflow prevention, ice, steam, and water treatment.

Personal hygiene: handwashing, glove use, hair restraints, illness reporting, and clothing policies for personnel and visitors.

Maintenance and calibration: preventive maintenance schedule and calibration of monitoring devices (thermometers, pH meters, scales) at defined frequency.

Quality management principles (ISO 9001): customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, relationship management.

PDCA cycle: Plan (establish objectives), Do (implement), Check (monitor and measure), Act (improve). Used for continual improvement.

Corrective action vs. preventive action: corrective action eliminates the cause of an existing nonconformity; preventive action prevents a potential nonconformity.

Root cause analysis tools: 5 Whys, fishbone (Ishikawa) diagram, fault tree analysis, Pareto analysis. Verify root cause before implementing action.

Key performance indicators (KPIs): measurable indicators (e.g., nonconformity rate, on-time corrective action closure, customer complaints) used to monitor process performance.

Measurement system analysis (MSA): assess accuracy, precision, repeatability, and reproducibility of measurement systems.

Statistical process control (SPC): control charts (X-bar/R, p-chart) distinguish common-cause variation from special-cause variation.

Document control: controlled documents have unique identification, version, approval, review date, and distribution; obsolete documents are removed or marked.

FSMA (US): Preventive Controls for Human Food (21 CFR 117), Produce Safety Rule, Foreign Supplier Verification Program, Sanitary Transportation, Intentional Adulteration.

HACCP regulation (US): 9 CFR 417 for meat and poultry; 21 CFR 120 for juice; 21 CFR 123 for seafood.

Codex Alimentarius: international food standards, guidelines, and codes of practice; General Principles of Food Hygiene (CXC 1-1969) and HACCP Annex.

GFSI-benchmarked schemes: BRCGS, SQF, FSSC 22000, IFS, GlobalG.A.P. Each has specific requirements for audit frequency, scoring, and certification.

ISO 22000: food safety management system standard; integrates HACCP principles with prerequisite programs and management system requirements.

Regulatory inspection vs. certification audit: regulatory inspections verify legal compliance; certification audits verify conformity to scheme standards.

Labeling requirements: allergen declaration, ingredient list, net quantity, country of origin, and nutrition labeling per jurisdiction.

Record retention: typically 2 years for general food records, longer for shelf-life or as specified by regulation or scheme.

Audit report contents: audit objectives, scope, criteria, dates, locations, audit team, findings (nonconformities, observations), conclusions, and distribution list.

Nonconformity statement structure: requirement (what should be), evidence (what was found), and significance (why it matters).

Corrective action request (CAR): requires root cause analysis, correction, corrective action, responsible person, and due date.

Correction vs. corrective action: correction fixes the immediate problem; corrective action eliminates the cause to prevent recurrence.

Follow-up: verify implementation and effectiveness of corrective actions within a defined timeframe; close nonconformities only when evidence confirms effectiveness.

Grading of nonconformities: critical (food safety risk, immediate action), major (systemic failure), minor (isolated lapse). Scheme-specific grading rules apply.

Report distribution and confidentiality: share report with auditee management and relevant stakeholders; protect confidential information.

Verification of closure: review objective evidence (records, photos, interviews) and conduct on-site verification if required by scheme or risk.