I recently joined a food safety startup, Provision Analytics, and have been using writing to document and clarify my own understanding. This is based on an internal document I prepared to share with the product team.
One of the things you don’t really think to ask until you get food poisoning or you work in food safety is, how can we trust the food we are eating? The food you eat is probably handled by someone other than yourself and the process is opaque to you in terms of what’s happening. In food, safety is one of the zero multipliers in the food business: it doesn’t matter how good your branding or price is if it’s unsafe. So you better get it right.
If you’re a business in the food supply chain or deal with the production of food (farmers, packer, processors, retailers, restaurants) you likely have a set of regulations you need to follow. These could be federally mandated by an organization like the FDA, or could be industry guidelines like GFSI programs. These exist to ensure companies meet a minimum standard of food safety in their operation and are intended to keep customers safe. These certifications are usually called Food Safety Programs.
The stakes of getting it wrong
Every recall is a blow to your public image and brand reputation. Not only that, but it can be incredibly expensive. If you don’t know what to recall, you have to proactively recall more to ensure you get rid of all the contaminated products. The average cost of a recall is $10,000,000 and that doesn’t include reputation or lawsuits.
Food safety exists to proactively limit the likelihood of these things happening.
Food Safety Certification Programs
When a company handles food, it must follow a set of safety standards known as food safety programs. These standards exist to ensure food is handled safely throughout the entire supply chain, from farm to fork. Depending on the region and industry, these programs could be mandated by regulatory bodies (e.g., FDA, USDA) or required by industry groups like GFSI (Global Food Safety Initiative). The most common programs we deal with include SQF (Safe Quality Food), BRCGS (British Retail Consortium Global Standards), and produce-focused standards like Primus, GlobalGAP, or CanadaGAP.
For large companies operating globally, managing compliance is complex. Each program comes with its own requirements, audit cycles, and focus areas, which can vary significantly depending on the product type and region. For example, a company selling both fresh produce and packaged goods in multiple countries might need to comply with different programs simultaneously. This overlap leads to administrative burden and potential conflicts in processes.
BRC 3.7.1
The site shall have a procedure for handling and correcting failures identified in the food safety and quality management system.
BRC 3.7.2
Where a non-conformity places the safety, legality or quality of products at risk, this shall be investigated and recorded including:
• clear documentation of the non-conformity
• assessment of consequences by a suitably competent and authorised person
• the action to address the immediate issue
• an appropriate timescale for correction
• the person responsible for correction
• verification that the correction has been implemented and is effectiveFood Safety Programs come in a variety of specifics but generally follow the same shape. They have process requirements (things you need to do in your operation) and documentation requirements (things you need to track in your operation). They outline things around handling hazardous chemicals, how they need to be labelled, stored, and employees should be trained. They cover hygiene and sanitation. Pest control programs. Temperature storage. These codes can be in the hundreds of pages for a single program with a single type of product. Now think about a global operation selling hundreds of different products in countries around the world.
And every year you have to get an audit if you want to remain certified. Auditors use the code almost as a checklist to make sure all of the requirements are met. This includes a combination of an auditor walking around the facility and checking machinery, cleanliness, staff behaviour, and more, as well as reviewing your records and documentation. Customers need to be able to pull up the relevant records for specific areas of the code to make their audit process seamless. Auditors want to see things like how someone was trained, what deviations happened in your operation, and how those were fixed. And did I mention every location needs their own program and audit? It’s not hard to see how the administration and management of this can easily be overwhelming.
Guidelines, not rules
Typically a food safety manager (or consultant) will review the relevant and interpret it for their operation. This is one of the first things an FSM needs to do — figure out how to turn this vague code into something they can adapt to their own situation and processes. They need to analyze their operational risks and likely make changes to how the operation works, is laid out, and even who does what. Based on the code, you usually need to prepare: the right process, train the team on the process, the documentation about the process (SOPs), and write the forms that will collect the data. For each and every process.
It’s hard to know all of that and it’s a lot of work.
While food safety programs provide a structured framework, they are more like guidelines than strict rules. Certification codes are intentionally flexible to accommodate the diverse operations found across the food industry. However, this flexibility means companies must interpret the guidelines and adapt them to their specific context. Here’s where the expertise of a food safety manager comes into play.
For instance, an SQF requirement might state:
SQF 11.3.3.1
The site shall undertake a risk analysis to ensure that the clothing and hair policy protects materials, food, and food contact surfaces from unintentional microbiological or physical contamination.
It’s vague on purpose. How you choose to meet this requirement depends on your specific risks, which vary by product type, facility layout, and staffing. A bakery might require full hairnets and beard guards, while a fresh produce packer may focus more on clothing contamination risks.
This interpretive nature creates a challenge: companies need to balance compliance with practical, operational needs. An auditor may ask, “Why are you doing it this way?” The answer must be backed by a risk-based rationale, often informed by scientific research or industry best practices. The lack of prescriptive rules makes the process adaptable but also creates inconsistency and complexity across operations.
Papering over
Collecting data within an operation is often done through forms. Lots and lots of forms. Forms for inspections. Forms for receiving logs. Form for equipment calibration.
And as if managing all of that wasn’t hard enough, most operations are still on paper. Estimates put it around 75% of the food and beverage industry relying on paper to collect data. Over the course of a single audit cycle you’re collecting thousands of pages of paperwork, thousands of pages of SOPs and Training documentation, and you need to keep it organized. Imagine trying to extract meaningful information or patterns from this, let alone stay on top of it all.
But paper works. There’s always a good reason for why people do the things they do. Paper is often easy to understand (pen + paper = ✔️) and easy to update the format. Change a .doc file and print 100 copies. Done. When you have all of these different forms and requirements to meed specifications, paper’s inherent flexibility becomes an asset.
At times managers will use a spreadsheet to organize across larger operations, and that tends to work too.
Going digital still meets a lot of resistance. For all of the benefits, there are a lot concerns around time to learn a new software and the flexibility of a tool that meets a businesses unique needs. Because food safety codes are left up to interpretation (within reason), a lot of businesses have slight variations in how they run things.
❄️ Most businesses have what I call snowflake syndrome. Every owner thinks their business is unique. Yes sure that solution might work for other businesses, but not us. You see we [some attribute that all companies have].
Some digital food safety tools (competitors) are very rigid in what they allow users to do and so customers have a hard time perfectly replicating their paper system in a digital one, a popular (if not misguided) goal. This has led to friction and often been an asset for Provision. Part of our strategy is to build the right level of standardization that allows us to be scalable while also appealing to large swaths of the supply chain.
Turnover & training
Since most of food relies on mother nature, and we have seasons, there are peaks and troughs in the seasons of an operation. As a result, they quickly staff up or down based on each year. And the work is challenging. The food industry has a lot of seasonal workers and high turnover. These workers are incredibly important to operations as they are the people-power keeping inventory and production moving and they don’t have the luxury of time to be extensively documenting their actions. But they have to. Well, they are supposed to. Adherence to the process and filling in paperwork is a big challenge in these operations. Whether it’s getting people to do it at all or just pencil whipping (half-assing it quickly, whipping the pencil across the page), this is a major issue getting the data.
Some of this is resolved by training but that can’t solve everything. And often times workers don’t speak English as their first language, making communication challenging for both groups.
Right now nearly 80% of all operations rely on pen and paper to document processes and audit requirements. And in a lot of cases, pen and paper can be faster than software! Any digital solution would need to be faster than paper and easier to learn, since employees will constantly be rotating and ongoing training will just slow a business down and add to their costs.
—
Food safety, like any operation, is that of continuous improvement. This means that not only is your operation (hopefully) slowly improving based on things you are finding in day-to-day operations, but regulations/certification requirements are also shifting based on what the industry deems important. Technology can help companies stay on top of these things and drive that improvement through best practices and data analysis.