Food safety

Your food safety system and your improvement programme are not talking to each other

Most food manufacturers run two competent systems that never meet: HACCP and the GFSI scheme on one side, lean and six sigma on the other. Recurring nonconformities live in the gap. Four connections that close it.

Most food manufacturers run two improvement systems that never speak to each other. There is the food safety system — HACCP plan, prerequisite programmes, the GFSI scheme the customer asked for — audited annually and owned by the technical or QA function. And there is the continuous improvement programme — lean, six sigma, OEE boards on the factory floor — owned by operations and measured on throughput and cost.

Both are usually competent. The gap between them is where the recurring problems live.

The symptom: the same nonconformity, every year

The clearest sign of two disconnected systems is a corrective action log where the same issues reappear on a roughly annual cycle. Metal detection checks missed at shift change. Allergen changeover records completed retrospectively. Cleaning verification failing on the same line, the same piece of equipment, every time.

Each one gets a corrective action. Each corrective action gets closed. And each comes back, because what was corrected was the instance rather than the mechanism that produced it.

This is not a food safety failure. It is a problem-solving failure, and the methods that fix it — structured root cause analysis, understanding process variation, mistake-proofing the step rather than retraining the operator — sit in the continuous improvement toolbox, on the other side of the organisational wall.

Why the split happens

It is rarely anyone's fault. It follows from how the two systems arrived.

The food safety system arrives from outside, driven by a customer requirement or a regulator. Its natural unit of work is the audit, its natural rhythm is annual, and its natural output is a finding. Success looks like a clean certificate.

The improvement programme arrives from inside, driven by cost or capacity. Its natural unit is the project, its rhythm is continuous, and its output is a metric that moved. Success looks like a number.

Those are different clocks, different vocabularies and usually different reporting lines. A HACCP team talks about critical limits and verification; a lean team talks about takt time and variation. Both are describing process control. Neither realises they are having the same conversation.

Four connections that do most of the work

Joining these systems does not require a reorganisation. In our experience four specific connections deliver most of the value.

1. Route food safety nonconformities through real root cause analysis. Most food safety corrective actions stop at the first plausible cause, because the audit closed and the finding needed a response. Applying the same structured analysis you would use on a quality defect — and holding the same standard of evidence for the cause — is the single highest-return change. A cause that cannot be explained to someone who was not there is not a cause, it is a guess.

2. Treat CCP and prerequisite data as process data. Critical control point monitoring generates a stream of measurements that is usually reviewed for compliance — in limits or out — and then filed. Read as a distribution rather than a pass/fail, the same data shows whether a process is drifting, which shift runs differently, and which line is operating close to its limit rather than comfortably inside it. That is early warning, available at no additional cost, from records you are already keeping.

3. Put food safety measures on the operational scoreboard. If the daily production meeting reviews output, downtime and waste, but food safety appears only when something has gone wrong, the organisation has told everyone which one matters. Adding two or three leading indicators — verification completed on time, changeover checks first-time-right — changes that without adding a meeting.

4. Let improvement projects declare a food safety impact. A line-speed improvement, a changeover reduction, a new supplier: each can affect a hazard analysis, and each is normally decided inside the improvement programme with no food safety review. A one-line question on the project charter — does this change anything in the HACCP plan? — catches the cases that would otherwise be found at the next audit.

What the standards already expect

None of this is an add-on to the certification you already hold. It is largely what the standards ask for, read properly.

HACCP requires verification, not just monitoring — evidence that the system works, rather than evidence that readings were taken. FSSC 22000, BRCGS, SQF and IFS all require management review, corrective action and continual improvement as explicit clauses. An auditor asking how you improve your food safety system is asking exactly this question, and "we close our corrective actions" is a weak answer to it.

The 2026 editions of ISO 9001 and ISO 14001 push in the same direction, firming up management review and — in ISO 9001's case — replacing "improvement" with "continual improvement" as a leadership obligation. The direction of travel across the standards is consistent: improvement as a running property of the system, not an annual event.

Where to start

If you want a single diagnostic, take your last twelve months of food safety corrective actions and sort them by cause rather than by date. If the top three causes account for most of the entries, you do not have twelve problems. You have three, and they have been recurring because nothing in the current arrangement was designed to find them.

That list is also the business case. It is considerably cheaper to fix three mechanisms than to keep paying for the same twelve findings every year.

Further reading

Riaz Ahamadeen, Vice President of Quality, Food Safety and Regulatory for North America at Oatly, set out the case for food safety and quality assurance continuous improvement programmes — why they are needed, what components they require, and how to implement one — in Implementing an Effective Food Safety and Quality Continuous Improvement Program, Food Safety Magazine, 10 April 2025. It is a useful companion to this piece: where he describes how to build the programme, the argument above is about what happens when the programme exists but runs separately from the food safety system.

Questions this raises

Do we need a separate continuous improvement programme for food safety?

No — a separate programme is usually the problem rather than the solution. The methods you need are the ones your operations team already uses for quality and efficiency: structured root cause analysis, understanding process variation, mistake-proofing. The work is connecting them to the food safety system, not duplicating them inside it.

Does a GFSI scheme require continuous improvement?

Yes, explicitly. FSSC 22000, BRCGS, SQF and IFS all carry requirements for management review, corrective action and continual improvement. An auditor asking how you improve your food safety system is testing that clause, and a corrective action log with recurring entries is evidence against you rather than for you.

What is the quickest indicator that our two systems are disconnected?

Recurring nonconformities. Sort your last twelve months of food safety corrective actions by cause instead of by date. If a handful of causes account for most of the entries, the corrective actions have been treating instances rather than mechanisms — which is what happens when findings are closed without the root cause analysis that the improvement side of the business uses as a matter of routine.

Can CCP monitoring data be used for improvement?

Yes, and it is the most underused data in most plants. Critical control point records are normally reviewed for compliance — in limits or out — and then filed. Read as a distribution, the same records show drift, shift-to-shift variation, and which processes run close to their limits rather than comfortably inside them. That is early warning from records you already keep.

Who should own the connection between food safety and improvement?

Whoever owns management review, because that is the one forum where both systems are already represented. The failure mode is making it a third function with its own meetings. It works when the existing improvement governance is asked to consider food safety measures, and the existing food safety governance is asked to use improvement methods.

Begin with context

Discuss how this applies to your operation.

Share the requirement, your current situation, and the outcome you are working toward.

Contact QSE