PROCESS CONTROL | June/July 2006

Vendor Certification Programs:

Improving Food Safety Through
Performance Tracking
By Les Lipschutz

No matter what link in the food supply chain, ensuring that your suppliers are delivering
safe, wholesome raw materials, ingredients or finished products is the first step in
process control. The food business is decidedly dynamic, with company expansions,
mergers and acquisitions, rising or fluctuating costs of doing business, market
globalization, and co-packing and outsourcing trends that all affect how food safety is
managed at every link in the supply chain. Instituting a vendor certification program as
part of your operation’s supply chain management system can have a dramatic impact
on improving food safety assurance and operational efficiencies that increase
profitability.

A vendor certification program (VCP) enables your operation—agricultural production,

processing, foodservice or retail—to systematically track performance of your vendors
and verify their compliance to your quality and food safety specifications to see which
ones provide the most benefit, both from a food safety and a business perspective. It is
more than a food safety or quality audit: The VCP is a major assurance link in your
entire supply chain, from the field to the customer or point of purchase. It is a food
safety and quality assurance management system that depends on an in-depth
knowledge of the product you produce or handle and how that product is made, handled
and distributed in order to verify with confidence that the items you receive from
vendors have been made or handled according to your operation’s specifications and
that the quality of your product is being carried all the way through to your customers.
Certifying vendors makes good sense both from a food safety/quality and a business
point of view.

Here, I’ll use examples from the whole and fresh-cut produce supply chain to illustrate
what you should consider when developing a VCP, although, of course, these principles
can be successfully applied to many food categories and their distribution channels. I
will also highlight some of the typical challenges you might find as you put together the
program and offer some suggested solutions to overcome them.

VCP Link by Link

The first step in developing a vendor certification program is two-fold: Ensuring that
you have a thorough understanding of your own processes and products and then
understanding how your products move through the supply chain, upstream and down.
This working knowledge will help you identify the key points of product receipt and
transfer within your own systems, your vendors’ systems and your customers’ systems in
order to best target those points where your operation’s performance tracking measures
will yield the most value in terms of food safety and efficiencies. A review of the typical
flow of raw materials and finished product through the primary supply chain links offers
an opportunity to develop a framework for the development of a vendor certification
program.

The Farm and Field Link. A thorough and comprehensive VCP begins in the field and at
the farm, and will involve review of harvest, post-harvest handling, packing and
shipping practices up to delivery of the raw materials to the processing plant receiving
dock. Both the growers and their buyers in processing or foodservice/retail links can
play a role in ensuring that the key verification points at this level are included in the
VCP. The grower-vendor will want to ensure that the agricultural product is grown to
the manufacturer-customer’s specifications and, with a good working knowledge of how
the manufacturer is making the product or how the retailer will handle or prepare the
product, will be able to identify areas of the operation that require food safety or quality
verification activities. Similarly, since the manufacturer-customer will want to provide
specifications that are straightforward and easily verifiable, it is important that this
supply link have insight into how the grower-supplier’s operations and protocols from
harvest to delivery work and where verification activities need to occur.

Good agricultural practices (GAPs), which identify best practices for sanitation and food
safety in agricultural operations, should be a part of every growing operation’s food
safety and quality procedures. Using the procedures outlined in the GAP program is a
good starting place to identify potential verification checkpoints that can be included as
part of a VCP. GAPs cover a wide range of practices involving pesticide use and
application, worker personnel hygiene and safety protocols, equipment and tool
sanitation, land and water management, packing and transport, which are all points in
the process that both supplier and customer want to ensure are being effectively
employed. One good agricultural practice, for example, is to make sure that agricultural
products are grown in an area that is not situated downstream from an animal feedlot.
This simple GAP prevents fecal waste containing pathogenic bacteria from flowing into
the field and contaminating crops. Whether you’ve sited the field effectively according to
GAP protocol can be easily assessed and verified by the receiver, which again is
beneficial to the grower who can show he is taking steps to grow the product in the best
possible ways for processing.

The traceability program is another good tool for supply chain companies to use to
identify verifiable activities. This is because the focus of traceability is data collection
and good documentation of all agricultural practices, such as fertilization, watering and
pesticide application schedules, which all need to be maintained in the event an issue
arises with the raw material or finished product at some other point in the supply chain.

After harvesting, the raw material product’s biological clock is literally ticking, which
means that the grower will institute post-harvest handling practices to eliminate or
reduce field heat in the product as soon as possible. Verifying that the product has been
taken to the appropriate cooler for packing—or, if the crop is packed in the field on
moving packing stations, that each station has been kept clean and sanitized on a daily
basis—are good examples of post-harvest practices that are points of verification activity
easily included in the VCP.

Once the raw materials are cool and packaged, the grower will want to make sure that
the trucks that used to transport the product have good temperature controls and are
clean and free of odors. Part of temperature control in trucks is to make sure there is
good air circulation in the truck too, as well as proper stacking of pallets or containers to
maintain the air control. This is a good example of a verification checkpoint that should
be included in the VCP. If you are not able to bring your raw material down to specified
temperatures, you cannot rely on the truck to do it for you. Truck cooling capacities are
only good enough to maintain the temperature of the products at the temperature they
are at to begin with—trucks are not a cooling facility.

The Manufacturing Link. Once the raw material arrives at the processing facility, good
protocols for receiving should be in place to make sure that the raw material meets the
processor’s specifications for quality and cleanliness, and in some cases, low microbial
counts. The receiving dock inspection of raw material usually entails the documentation
of many food safety and quality data points that are easily included in the VCP,
including the receiving temperature, sanitary conditions of the delivery truck, and
whether dirt on pallets are clean or excessively soiled. If the processor has an incoming
microbial count specification, a good representative sampling plan should be in place—
in other words, QA staff are not just collecting one lettuce at the top of the pallet as the
sample—and the sampling data can be included in the VCP scheme.

It is also to the processor’s advantage to know of any abnormal growing or harvesting

conditions associated with a particular lot to effectively plan how to process that
material. For example, in California recently there has been excessive amounts of rain,
which will impact the quality of the agricultural raw material. This means that the
processor will need to cut off and discard more of the raw material than typical in order
to maintain the quality parameters desired in the finished product.

Of course, all food products must be in compliance with Title 21, Part 110 of the Code of
Federal Regulations (CFR),within which there are specific temperature,
sanitizer/oxidizer, water conveyor location, foreign material detection and other food
safety requirements for processing operations. Data documentation generated for all
activities that are performed in processing will include several potential verification
points such as production dates, use-by code, daily or hourly production run codes,
quantity produced, metal detector verification reports and organoleptic data for the
product processed.

Finally, when product is ready for shipping there is typically some type of code dating
and an agreed-upon use-by date on the finished product package. In order to facilitate
both the manufacturer-supplier’s and the downstream customer’s VCPs, the
manufacturer also provides identification (ID) on cartons for shipping; i.e., the
traceback code information, which includes processor’s name, code date, hourly
production, expiration date, and plant line ID.

The Transportation/Distribution Center Link. Vendor certification checkpoints at this

stage of the supply chain can be variable depending on the distribution channel but are
nevertheless important to include in a VCP. Some are more fixed. For example, usually
the manufacturer-vendor has requirements as to how quickly the pallets must be
shipped from the production facility, ideally in less than 24 hours, and carriers or trucks
must be properly bonded and insured and they should be practicing first-in/first-out
(FIFO). These practices are easily verified.

However, depending on the company and where the product going (i.e., it may go
directly from processor to the end customer such as to a chain restaurant operation, or it
may go through a distribution center and then on to the customer), maintaining the cold
chain, sanitation and pest control best practices—and the myriad specific practices
therein—can present a more complex matrix of verification checkpoint possibilities. For
example, cold chain verification points will differ if product is being cross-docked versus
direct-delivered, and so it is important to assess the specific transport and distribution
channels for each product shipped and/or received in order to establish specifications
that effectively address food safety or quality concerns.

The Foodservice-Retail Link. When the product arrives at point of purchase or use,
another set of vendor certification point opportunities appear. It is always important
that, at the point of final destination, product temperatures and cleanliness of the
delivery vehicle are checked. The receiving company should also look at inventory to
make sure they are getting what they are paying for upon receipt of the product.

Within the foodservice/retail operation self-evaluation for verification checkpoints is

key to ensuring food safety and quality. At this link in the food supply chain, your
vendor certifier is the consumer, whose “vendor certification program” has one basic
requirement: that the foods prepared, handled and served are safe for consumption,
period. In other words, the forward-thinking foodservice or retail operator will develop
a store-level VCP that will incorporate verifiable checkpoints within stores and from
outlet to outlet. Areas of concern may vary from store format to store format, but in
general you’ll want to verify that temperatures in refrigerated storage areas or units are
accurately and consistently held; that if the product is being opened and used to make
other final products in a kitchen or food handling preparation area that good sanitation
programs are in place and that all employees are trained in proper sanitation
procedures; and that if a problem arises, the traceback program is effective.

Each of the fundamental supply chain actors outlined above have systems in place that
that provide the opportunity to identify specific areas that should or must be included in
any VCP. The primary systems—quality, food safety, distribution, and retail—are briefly
discussed here in terms of some of the common challenges that may arise as we consider
them for inclusion in the VCP.

Quality Systems
Quality assurance and control systems primarily involve the recordkeeping that is
needed to verify that you are doing what you are supposed to be doing. This system may
overlap with some areas of the food safety system in terms of recordkeeping, such as
HACCP support programs (SSOPs and prerequisite programs), GAP/GMPs, as well as
allergen control, glass and nonmetal foreign material control, and bloodborne pathogen
programs. The availability of QA/QC documentation is very helpful for determining
vendor-related verification activities in areas such as supplier monitoring, product
traceability systems, employee training, and non-critical (or quality) control points
related to the HACCP program.

Supplier Monitoring. The first area of interest when developing a VCP is the supplier
monitoring program that is commonly part of the quality system. This entails looking at
all of the vendors who are supplying your operation with product and determining
whether they are delivering raw materials, ingredients or finished product that is of
consistently good quality and that meets your established specifications. Documented
supplier monitoring data will show whether the product varies in any quality parameters
from delivery to delivery, allowing the receiving company to identify consistently
reliable vendors and those who are not through trending. When it comes time to put out
new contracts for the year, the receiver has solid information from which to decide
whether prices need to be adjusted, whether certain suppliers should receive preferred
status, or even whether to drop a supplier altogether.

Of course, the challenge is collecting the data in such as way as to make it useful for your
purposes and in a format that allows trending of the information. Collecting data from
multiple vendors quickly accrues into an enormous amount of information, adding to
the challenge. With an electronic data collection and management system in place, the
operation can more effectively gather and manage critical information on its supply
channels. For the most part, larger food supply chain companies have established
information technology programs. Mid-sized and smaller operations that do not have IT
capability are finding that in order to do business with customers in the supply chain
that do requires that they also obtain some data management capabilities, even with
limited resources.

A number of information technology companies are developing computer-based systems

for supply chain monitoring tasks, providing large databases that can manage huge
amounts of data for a food operation. Of course, a simple Microsoft Excel program can
be used to manipulate data, as well. In either case, however, the old admonishment
“garbage in, garbage out” applies. First you need to understand your data gathering
goals and then include the specific identifiers and information required to meet those
goals in such a way as to be able to sort the data into meaningful trending information
from which to make decisions. When you know what you want to look for you must also
be able to convey your aims to IT technicians who may have never seen a field, the
inside of a processing plant, or even the back kitchen of a restaurant, so they can
translate it and put it into an appropriate computer database.

Employee Training. The employee training and education program is a very important
element of a company’s quality systems and several activities within this program can be
used as checkpoints in the VCP. Downstream customers will want evidence from the
manufacturer-supplier that plant employees are well trained in GMPs and retrained or
given refresher courses on a regular basis throughout the year, and even may want to
verify that employees are monitored on some routine basis to ensure that they are
following personal hygiene protocols and performing sanitation-related tasks properly.
Similarly, the manufacturer-customer will want to know that its grower-vendors can
verify that field workers have been educated in GAPs and are consistently applying these
practices during harvest and post-harvest handling activities. Verification points might
include whether employees know to periodically sanitize cutting knives and other field
tools, whether they are using portable toilets and washing hands properly after use, and
whether they understand the importance of not eating in the field or in the area where
they are handling or processing the product.

Product Recovery and Traceability. The FDA has specific requirements for product
recovery and traceability for Class I, II and III level recalls. These requirements include
providing information on the number of companies that you sold the product to and
whom you’ve contacted, how much of the product you were able to bring back from the
stores and verification that the product was either destroyed or if it is just a code date
issue, that it was corrected and reprocessed. By understanding the steps involved in an
FDA recall, an operation can identify the minimum elements that need to be included in
the traceability program—and therefore, appropriate data points for the VCP.

For traceability to be effective a coding system must be set up that will include
identifiers for raw materials used, the product being made, the product processes used
in manufacture, the production line, and if possible, even the hour that product was on
the line. For traceback purposes, identifiers on the pallets on which product cartons are
placed is also a good idea.

The challenge for the processor is achieving traceability when the operation is using
more than one raw material and making combinations of products on multiple lines. For
example, you may use shredded carrots, cabbage and lettuce over a two-day production
period to make various combined products such as a cole slaw with cabbage and
shredded carrots. Adding to the complexity is the likelihood that parts of the pallets of
one or more of these raw materials is stored for use in a production run on the third or
fourth day after its arrival at the plant. Somewhere along the line, the final product
sheets for every different product processed needs to include all of the pertinent
traceability data points—and it is not just one number, it is a number of numbers, which
can make it very difficult to keep individual components identified. Ultimately, this is
another compelling reason for establishing an computerized data collection and
management system.

Similarly, if a problem is noted at retail level the ability to trace back that finished
product all the way to its point of origin is imperative. If a 20 lb. carton containing four
5 lb. bags of lettuce is delivered to a foodservice location for use as sandwich garnish, for
example, but the traceback coding is only printed on the carton and not the individual
packages, when the carton is unpacked and thrown away the operation’s traceback
ability is severely hampered. Including traceback information on the billing invoice is
suggested because it provides a paper record that you can use to trace the product back.

HACCP. Companies often identify the HACCP program as part of the quality system
because it is record-keeping intensive and provides quality control data points, as well
as food safety critical control points (CCPs). When HACCP first began to catch on in
operations outside of the food categories for which it is a mandatory program,
processors often identified QC points as CCPs. In the fresh-cut produce industry, for
example, nearly a dozen CCPs were initially identified for the typical fresh-cut
operation, although the majority of these did not pose a potential for causing injury or
illness should the product or process become out of control. In other words, a number of
the CCPs were actually quality control issues not CCPs, and today, most of the
operations in the fresh-cut sector have identified two or three true CCPs. This makes
recordkeeping for CCPs much more manageable but most operations will maintain
records on the non-critical quality points such as product shelf life measurements, label
controls, and organoleptic specifications that can be used for other verification goals.

Food Safety Systems

Although the quality systems and food safety systems do overlap in many areas, the
GAP/GMP/Prerequisite Programs (PRP) and HACCP verification systems for true CCPs
provide us with the most pertinent food safety-related data points that should be
included in the VCP.

GAP, GMP and PRPs. These programs involve documenting controls in sanitation, pest
control, processing, personnel hygiene, and receiving/storage/ shipping activities. Using
the records generated under these programs can help you to understand the most
critical food safety practices that your customer will likely want to verify. For example,
the manufacturer-customer will want documentation of the type, frequency and
application of crop pesticides and the corresponding controls that the grower has in
place for the contracted raw material. The retailer-customer will want to know that the
manufacturer-supplier has taken steps to ensure that the pest control company
employed by the plant is licensed and that the individual pest control technician also has
a license from a state or county agency.

Similarly, the processing plant’s ability to show buyers that sanitation activities are at
best or better-than-best practices level means showing that SSOPs are in place, are
monitored and verified to be working. This in turn means that the manufacturer should
be able to verify the products obtained from the sanitation chemical supplier. As the
processor monitors the cleanliness of equipment and production areas, data may show
that the detergent or sanitizer used in not as effective as required, and further
investigation may show that the problem is not in the application. The chemical supplier
should be able to provide guidance about changing the product, frequency or
dispensation method to achieve the desired cleaning and sanitizing effectiveness for
your particular system. With this professional advice and the use of automatic cleaning
chemical dispensing equipment that collects electronic transferable data and generates
chemical type, amount and frequency of dispensing, the processor has verified
documentation of food safety control to share with customers downstream.

HACCP Verification. As alluded to earlier, true CCPs typically are few in number n a
given food processing operation, depending on its complexity, and from any food supply
chain customer’s viewpoint these are must-include data points in a VCP. The three
common CCPs in a fresh-cut operation, for example, are the raw material first wash;
finished product temperature measurement; and metal detection monitoring and
control. Each of these CCPs have specific control, verification and corrective action
requirements documented in the HACCP plan. At the first CCP, first wash of raw
material, the water temperature and oxidizer used are monitored in order to maintain
the pH of the water at a level effective in reducing or eliminating microbial food safety
hazards. Verification of this CCP involves the routine measurement of temperature to be
sure the water is cold enough and the oxidizer to ensure that the type you’re using is
effective and the amount used is correct. The second CCP, control of the finished
product temperature is important because once the product is in its packaging, put into
the shipping carton and then placed on the pallet, it becomes very difficult to bring
down the internal temperature of the packaged product set in the middle of the pallet to
a specified level. The way cartons are packed and stacked on the pallet provide some
preventive control, and verification of that these controls are effective happens at the
receiving end. Most metal detection systems, the third CCP, are automated and thus can
provide continuous, verifiable documentation that these critical systems are working.

With each of these CCPs, there is likely on-site verification testing that is being done to
provide additional assurance that automatically monitored CCP measures are working
effectively, and this information is also of interest to your customer. You may have an
automatic method of measuring wash water temperature and oxidizer, for example, but
you need an alternative method to verify that what is being used on a routine basis is
actually reading correctly and that this is done periodically throughout the day. The
metal detector may be automated but testing the system’s accuracy by manually putting
three different metal samples through the machine to make sure the detector actually
detects all such objects provides you and your customer with confidence that the system
is operating properly.

Customers may specify that suppliers provide a certificate of analysis (COA) to show
that microbiological testing of finished product has been conducted. Certain types of
microbiological testing can help you obtain information about what you need to be
doing, or doing differently, in your process to reduce spoilage organisms or pathogenic
bacteria loads prior to sending product to your customer. Total plate count or aerobic
plate counts can tell you the general microbiological load on the product but these tests
will not differentiate organisms, so the results will not necessarily be useful in
determining whether there is a foodborne illness-causing pathogen present. Coliforms
are ubiquitous in any agricultural field. High counts may suggest additional testing
specifically for E. coli O157:H7. Similarly, high yeast and mold counts are not
necessarily indicators of food safety problems, but their counts are inversely
proportional to the product’s shelf life. In any event, if the customer requires a COA for
specific pathogens of concern, be sure to use a test method that differentiates those
organisms.

Distribution Systems
While there are numerous variabilities in the methods and channels of distribution and
transportation among food supply chain links, there are some essential commonalities
that can be addressed in any VCP. One of the most important areas that downstream
customers will want to verify at this point in the supply chain is cold chain
custody/temperature maintenance.

Once the product leaves the field or dock the grower or processor typically has no
control over the product. However, if a refrigerated product arrives at the customer’s
facility in a temperature-abused state, you will need to be able to show that the initial
quality problem did not begin at your facility. Placing a temperature recorder in the
delivery vehicle is one of the best things a supply side operation can do because the
device provides a way then to get information back to verify the quality of the product
after shipping.

Growers, processors and foodservice/retail outlets can all incorporate this into their
particular VCPs, since the vendor being verified is the trucking or distribution company.
To be effective, however, there must be good cooperation on both the shipping and
receiving ends because every recorder needs to be recaptured in order to benefit from
this data. Thus, if at the receiving end the recorder goes unnoticed and is thrown away,
it cannot be sent back to the shipper to check or cull the information from the device.
The radio frequency identification device (RFID) is an emerging technology that also
can be used to monitor and verify that the cold chain of a product has been maintained.

One of the interesting things about temperature maintenance, especially now that
gasoline prices have skyrocketed, is that more frequently uninformed truckers are prone
to turn off their reefers once they leave the dock to save fuel, only turning them back on
at the end of the trip. If refrigerated product warms for a length of time during transit,
the bacterial count in the product can increase and easily go unnoticed at receipt,
resulting in shortened product shelf life, or worse, providing pathogenic bacteria an
opportunity to survive and grow. This is another good reason to place some kind of
temperature tracking recorder in the transportation vehicle because even though the
temperature at shipping and the temperature at receiving may be the same, the recorder
will show if there was a product temperature spike while in transit.

Store Verification Systems

At this link in the chain, where food handling becomes prevalent, it may seem strange to
talk about vendor certification solely because the foodservice or retail customer would
appear to be the end of the food chain line, primarily receiving goods from vendors.
However, restaurants and grocery stores that handle and prepare foods are likely to face
the ultimate food safety and quality verifier: the consumer. So while it is very important
that food retail outlets ensure that its vendors deliver safe, quality product through a
VCP, it also is important that this link institute some form of self-verification system,
administered through either internal verifiers or third-party auditors who visit all stores
to make sure each location is following food safety and quality specifications.

Activities that should be verified largely mirror those the retailer would require of the
manufacturer-supplier. These include temperature/cold chain maintenance for
shipments at receiving, temperature documentation for cold storage facilities and
trucks, and through a refrigerated product’s entry into any food preparation area.
Sanitation activities at store level should be routinely monitored, including personal
hygiene and hand washing, work station cleaning and sanitizing, proper storage and
handling of chemicals, proper utensil and equipment cleaning and preventive measures
to avoid cross-contamination.

VCPs: Worth the Investment

We’ve discussed here some of the general principles and a few specific
recommendations of the areas to consider when developing a vendor certification
program for your operation. It is in the company’s best interest to invest the time itself
in evaluating existing quality, food safety, distribution and field-, plant- or store-level
programs to identify the data points that can be reasonably documented and verified.
Instituting a VCP as part of your operation’s supply chain management system can have
a dramatic impact on improving food safety assurance and operational efficiencies that
increase profitability—but only if you truly understand your product and systems from
the inside out and can communicate meaningful data to both your suppliers and your
customers.
Les Lipschutz now owns Food Safety, Inc., a consulting company that specializes in food safety
operations, HACCP implementation, process problem solving and sanitary design of facilities
for the fresh-cut produce industry. Les has over 20 years experience in the fresh-cut produce
business, including Grimmway Farms, which became the first national vegetable processor to be
certified by the USDA Quality Through Verification Program under his watch. As Vice President
of Quality Assurance.with Redi-Cut Foods, Les initiated an electronic data management system
for the HACCP program. As Senior Director of Product Safety for Del Monte Fresh Produce
Co., North America, Les developed corporate food safety policies and related management
systems for the fresh-cut operations, domestic ports, distribution centers, growing locations and
the tomato, potato and onion repack operations. He became the industry leader in developing
electronic data management systems for corporate audits; HACCP related processing data,
facility audits, inspections and evaluation of recall programs.
Categories: Regulatory: Audits/Certification/GFSI