This article originally appeared in Food in Canada and is republished with the permission of the publisher.
Now that the July 15, 2020, implementation date for the licensing, traceability and preventive controls requirements under the Safe Food for Canadians Regulations (SFCR) has passed, many food businesses dealing in manufactured foods are facing a new challenge - implementing and verifying the compliance measures they have put in place. While most food companies have in place appropriate food safety and compliance systems, it is also important to ensure that your company has documentation to establish that you exercised due diligence to prevent non-compliance.
Given the potential consequences for offences under the Safe Food for Canadians Act (SFCA), the necessity of doing your due diligence with respect to compliance is clear. Under the SFCA a person who contravenes provisions relating to regulatory compliance can be liable on indictment to fines up to $5 million or to imprisonment or to both. However, the law also provides for a due diligence defence to certain offences, provided that the person can "establish that they exercised due diligence to prevent the commission of the offence."
As explained in detail by Ron Doering in his column "Get of out of jail free", the due diligence defence turns on the notoriously vague concept of reasonableness and there are few relevant cases to provide practical guidance to the food industry. Though Ron's column on the due diligence defence pre-dated the full coming into force of the SFCA, his conclusion holds true today, exceeding standards and taking all preventative measures may also be the best way to stay out of jail.
The challenge with regulatory compliance lies not only in designing and implementing effective compliance procedures, but also ensuring your business has documentation to demonstrate compliance - not a simple task.
Take for example the seemingly straight forward step of verifying that a supplier you're doing business with has been licensed under the SFCA. The CFIA publishes a Safe Food for Canadians Licence Registry on its website, listing food businesses licensed under the SFCR that are considered to be in good standing with the CFIA. This is an excellent tool to assist industry in confirming a licence holder's status (bookmark it!). However the registry does not list all licence information that may be needed as part of a supplier verification program. Going one step further and requesting a copy of the licence would provide information such as the expiry date, but a licence is also limited to the foods and activities for which it was issued. The specific foods and activities covered by the licence are not provided on the Record of Licence, rather it indicates "Information on the activities, foods, establishment locations and status of the licence can be provided by the licence holder." And so, even the licence only tells part of the story - the licence holder must confirm that the licence covers the appropriate commodities (e.g. meat, fish, beverages) and activities (e.g. import, labelling) on which you rely.
Due diligence can also be a challenge given the complexity of the food supply chain. Compliance with the SFCA is a responsibility of all who sell, advertise or have in their possession, a food - including manufacturers, distributors, importers and retailers. As a result, each party may be called upon to demonstrate that they have exercised reasonable care by establishing a proper system to prevent non-compliance and that they have taken reasonable steps to ensure the effective operation of the system. There is no one size fits all approach.
The SFCR also requires licence holders to have in place procedures for verifying that the implementation of their preventive control plan (PCP) results in compliance. Verification is an integral component of an effective PCP and a principle in the Hazard Analysis Critical Control Point (HACCP) approach to food safety. While the SFCR does not prescribe how to conduct verification procedures, the CFIA has published guidance including best practices and practical suggestions, for example:
- use external qualified third parties when verification cannot be carried out by in-house staff
- adjust the frequency of verification in response to the identification of problems
- review records documenting the monitoring activity to ensure the proper version of the record is used, records are complete and filled out as per the written procedures
Establishing that you exercised due diligence involves more than simply collecting tons of records to demonstrate that there are systems in place, or that the system is operating - it involves taking reasonable steps to ensure that the system is actually working, and keeping the information collected as evidence that you did your due diligence.