Just when you thought life as a technical manager could not get any more difficult, along comes BRCv7 and Vulnerability Assessments…
In my opinion, this will prove to be a huge challenge to a vast number of people in our industry, in fact, if you are aware of anything that presents an equal or greater challenge across the industry, I would be delighted to hear from you. So why do I feel so pessimistic?
1 – No definitive guidance or best practice
Any site audited from July must comply, and my view is that much of the guidance disseminated so far, has been purely theoretical, giving us no more than a steer on the steps to take and how to complete a vulnerability assessment. But the devil will be found in the detail.
Vulnerability to food fraud will be determined on a ranging scale from low to high. Low will include vertically integrated supply chains owned by the food business, and high will be global supply chains for ingredients such as; ground beef and olive oil, where there is a substantial history of fraud.
The big question to be answered, is what will happen to everything in the middle? Most food businesses will have a majority of ingredients that fall into this middle range, and it may take quite a few years before any recognised ‘best practice’ starts to emerge.
2 – Auditors will be finding their way
It won’t be any easier for auditors; who are already under intense scrutiny; as the GFSI and Standards owners endeavour to improve audit consistency. I envisage that audits will be conducted across multiple sites, without the availability of any definitive best practice.
It is very likely that they will begin to favour specific approaches, bringing their preferences to other auditee sites, who may have taken an alternative approach. Auditors may have extensive experience of an individual sector, which will put them at a distinct advantage over the generalist technical managers; who are required to risk assess a wide array of ingredients; at the same time as managing their sites.
3 – Ambiguity prevails
Until a recognised best practice becomes established, this will cause ambiguity within the industry, leaving a situation that will be open to differences of interpretation. Auditors and technical managers are specialists in their fields and will therefore identify what they believe is the best approach, based on their individual experience. Hence I anticipate lots of debate.
Consider how many food businesses still get non-conformances on HACCP. I would argue that HACCP is a far less complicated concept to understand than vulnerability assessment.
4 – Fraud risks exist in every sector of society, yet food businesses are expected to prevent fraud in their supply chains.
Identity fraud, credit card fraud, phishing……the list is endless. So taking credit card fraud as an example; the banking sector is comprised of a small number of very big, highly profitable businesses; and yet they have not succeeded in stamping out credit card fraud. It still happens every day.
Is it reasonable then, to expect the food industry; many of which are small and medium sized businesses; to prevent fraud in their supply chains?
5 – Too many variables
Despite many years of having to complete supplier risk assessments, where the list of variables is shorter and more absolute, many food businesses have struggled to conduct robust and consistent supplier risk assessments. With vulnerability assessments however, there are too many grey areas, ambiguities and unknowns. There are just too many variables.
6 – The sands are shifting
Vulnerability assessments require constant review and an annual update. Most food businesses will not have the resources or the IT capabilities to track all the variables that could have an impact on the vulnerability assessment. Too many of the variables are constantly moving, for us to keep up.
7 – Even the best vulnerability assessment is likely to fail
In spite of all of the best efforts by thousands of experienced professionals across the food industry, the pessimist in me feels that we will still succumb to the fraudsters, whilst we continue to be lambasted by the media; except the charge sheet will now include, that we are failing to comply with our own industry standards.
Please let me know if you feel I am being too pessimistic, I would appreciate the opportunity to discover a more optimistic perspective…