The Canadian Food Inspection Agency is relying too heavily on third-party audits paid for by companies in a system where the regulator does not inspect all production facilities itself, experts say.
The audits are one part of an algorithm-based system used by the CFIA to assess risk levels at Canada’s 8,000 federally licensed food-processing plants. The algorithm helps determine which plants are prioritized for inspection and which ones get less attention, or no inspections at all.
The third-party audits – an aspect of the food-production industry that has come under criticism in the United States for its lack of independence – are used by companies to show they have control plans in place to prevent outbreaks of dangerous pathogens in their facilities. Many large retailers require that suppliers undergo third-party audits and receive third-party food-safety certifications in order for the suppliers’ products to be sold at their stores.
Third-party audits are factored into the CFIA algorithm as one of several potential mitigation measures that could reduce the risk level assigned to a particular facility. However, those audits, experts say, vary in their rigour and depend significantly on the competence of the individual auditor. Such audits are also paid for by the companies being audited, and aren’t always unannounced.
“Too much weight has been put on these audits,” said Dr. Lawrence Goodridge, the director of the Canadian Research Institute for Food Safety at the University of Guelph. “The CFIA, as a regulatory body, has to do its job – which is to inspect.”
The CFIA said in an e-mail to The Globe and Mail that third-party audits are only one part of the algorithm system, known as the “Establishment-based Risk Assessment” model, or ERAM.
“Third-party audits never replace CFIA inspection activities,” said Pamela MacDonald, executive director of inspection support for the agency. “Companies can choose to use third-party audits but these are a minor factor in the ERAM model, which takes into consideration the efforts made by industry to reduce their food-safety risk.”
However, a Globe investigation last week found the algorithm had determined that a facility in Pickering, Ont., linked to a deadly listeria outbreak this summer was deemed a lower priority for inspections. As a result, the site had not been visited by a CFIA inspector in the five years leading up to the outbreak. It was only after the outbreak that the CFIA says it discovered the plant had not been conducting testing for listeria in finished products or on food contact surfaces.
Using genome sequencing, public-health officials determined that the listeria strain involved in the outbreak sickened 20 people as far back as August, 2023. Three people died.
The Pickering facility is operated by Joriki Inc., a privately owned company that was contracted by Danone Canada, a subsidiary of French dairy giant Danone SA, to make plant-based milk products. Millions of Silk and Great Value products were recalled on July 8. Danone told The Globe it had conducted its own audits on the facility, but did not provide information about when they took place, how they were conducted or what was found.
In a statement to The Globe, Joriki said its listeria-monitoring program included swabbing the production line and conducting finished-product testing. The CFIA never raised any concerns about its program prior to the outbreak, the company said, adding it has only seen government data on one of the outbreak cases.
Joriki also told The Globe that the facility has been subjected to annual third-party audits and has achieved third-party certifications related to its food-safety management systems. Specifically, the company said its environmental monitoring program was “approved by its customer and reviewed by third-party independent certified auditors.” The company did not provide The Globe with details of the audit reports.
Food producers provide self-reported information to the CFIA for its algorithm, which informs the level of oversight required by inspectors.
The algorithm incorporates 16 risk factors, including the facility’s compliance record, the type of product being made, how it is produced and what mitigation steps are in place. One of the inputs is whether the facility undergoes third-party audits.
Similarly, third-party food-safety certifications obtained by facilities are also factored into the risk calculation, which has drawn concerns from experts that they’re being relied on instead of federal oversight.
In communications to industry about the algorithm-based ERA model, the CFIA describes a third-party audit as “the use of a private, independent service provider, organization or company to verify that the regulated party adheres to a food safety standard.” These audits, the CFIA said, are voluntary and “are not meant to replace regulatory inspections.”
But even though the Pickering site was subjected to third-party audits and obtained third-party certifications, the CFIA, in response to questions from The Globe, could not provide a date for the last time the facility in question was inspected.
Third-party audits have become a significant component of the food-safety system. Gordon Hayburn, a Canadian food-safety and auditing expert with more than three decades of experience in both the private and public sectors, said without third-party auditors, some premises might never be subject to any type of inspection or oversight.
“There are far more third-party audits than there are CFIA inspections,” Mr. Hayburn said. “Most consumers are probably of the opinion that the CFIA is managing food safety among manufacturers in Canada – and they’re not, because of the lack of resources. The CFIA is not delivering on a proper food-safety mandate.”
He pointed to numerous instances in the U.S. of third-party auditors failing to detect problems at food-production facilities, including the 2011 case of a deadly listeria outbreak in Colorado that was traced to cantaloupes from Jensen Farms. In that case, inadequate third-party audits played a key role in the problem, he said.
Mr. Hayburn said third-party auditors don’t do product testing or swabbing, although they will review the site’s environmental-monitoring program and go over its results. He said his greatest concern with third-party audits is their variability.
“I don’t believe all auditors are as competent as they ought to be because I feel there are too many audits needed and not enough good auditors,” said Mr. Hayburn, a former technical director of a third-party audit firm. He added that the quality of the audits also depends on the integrity of the information provided by the producers themselves.
The Globe investigation found that the vast majority of the country’s federally regulated food-production facilities – roughly 80 per cent – fall into the lowest two risk categories in a seven-level system. Many such facilities are targeted for what the CFIA described as “less detailed” annual inspections of the facility’s preventative control plans. Such targets, though, aren’t always met, leaving some plants uninspected.
Dr. Keith Warriner, a professor of food microbiology at the University of Guelph and the former president of the Ontario Food Protection Association, said the CFIA has been “shifting the responsibility” of food safety onto manufacturers and third-party auditors.
“The philosophy is about focusing resources where they’re needed, but what happened with the plant-based milk shows you how fragile the system is,” Dr. Warriner said, referring to the summer’s listeria outbreak. “The CFIA thought the third-party auditors would have everything under control, that the retailers would have everything under control, and then onward and so forth. The reality is that none of them had anything under control. And that’s where the system breaks down.”
