Audit of the Management of Imported Food Safety

The primary timeframe covered was April 1, 2005 to March 31, 2008.

July 2010

Table of Contents

• Executive Summary
  • Introduction
    • The Safety of Imported Foods
    • Audit Objective and Scope
  • Findings and Recommendations
    • Governance
    • Controls
    • Risk Management
  • Statement of Assurance
  • Audit Opinion
• 1.0 About the Audit
  • Entity Background
  • Audit Objective and Scope
    • Objective
    • Scope
  • Audit Methodology
    • Criteria
    • Approach
• 2.0 Findings and Recommendations
  • Governance
    • Finding 1: Agency-Wide Strategy Specific to Imported Food Safety
    • Finding 2: Accountability for Strategic Direction
    • Finding 3: Information Systems
    • Finding 4: Performance Reporting
    • Recommendations - Governance
  • Controls
    • Finding 5: Resource Management
    • Finding 6: Compliance and Enforcement Activities
    • Finding 7: Operational Controls
    • Recommendation - Controls
  • Risk Management
    • Finding 8: Agency-Wide Risk Analysis
    • Finding 9: Planning Across Commodities
    • Recommendation - Risk Management
• Appendix A: Audit Criteria Guidance
• Appendix B: Management Response and Action Plan

Executive Summary

Introduction

The Safety of Imported Foods

In recent years, Canada has experienced increased volumes and diversity of imported food:

• The inflation adjusted value of food imported increased approximately 45% in the past 10 years, growing from $14.2 billion in 1997 to $21.8 billion in 2006.
• The number of countries from which Canada imports food products increased from approximately, 143 in 1990 to 193 in 2005.

Imported foods are subject to domestic food safety related requirements (e.g. standards and regulations) once they enter the domestic handling and processing systems. In terms of food safety controls for imported food, there may be requirements placed on the countries of origin and foreign suppliers to meet Canadian food safety requirements before a product is imported; and when a product does enter Canada, border point-of-entry control requirements must be met.

The Canadian Food Inspection Agency (CFIA) verifies industry compliance with Federal Acts and Regulations through a number of inspection, sampling and surveillance activities. Within the CFIA, responsibilities are assigned to three branches; Science, Policy and Programs, and Operations. The management control framework for the safety of food imports is largely embedded into the management of all CFIA food commodity programs and related activities. Import control activities vary from one food commodity program to another, in accordance with their respective legislative and regulatory requirements.

Audit Objective and Scope

The objective of the audit was to provide assurance to senior management that CFIA's imported food activities are designed, organized, and delivered in order to achieve food safety objectives.

This audit focussed on assessing how the CFIA manages food inspection activities to reduce risks associated with imported foods, including the management control framework in place for imported food safety. Audit work was also carried out to assess the extent to which the CFIA is positioned to manage risk and achieve objectives related to imported foods.

The scope of the audit included the food import activities of the Science, Policy and Programs, and Operations Branches of the CFIA. The audit assessed activities related to import controls for all nine food commodity programs: meat, fish, eggs, dairy, maple, honey, fresh fruits and vegetables, processed products, and products regulated only under the Food and Drugs Act (referred to in this report as non-federally registered products). The CFIA organizes many of its activities around these commodity groupings; grouped according to the legislative and regulatory requirements.

Import practices and controls were assessed horizontally across the programs. The primary timeframe covered was April 1, 2005 to March 31, 2008, with documentation and information outside of that timeframe considered if relevant to current management practices.

The activities related to Health Canada's role with respect to setting policies or standards were not in the scope of the work performed. Import control arrangements under the Memorandum of Understanding (MOU) between the CFIA and the Canada Border Services Agency (CBSA) were assessed as a separate audit project.

Findings and Recommendations

Governance

Finding 1: Agency-wide Strategy Specific to Imported Food Safety

The Import Control Policy remains to be fully implemented and an Agency-wide strategy specific to imported food safety has not been developed.

Finding 2: Accountability for Strategic Direction

Accountability at the Branch level and within the food commodity programs is well defined. Accountability for managing the Import Control Policy and strategic direction is not clearly defined.

Finding 3: Information Systems

The CFIA's systems do not provide consistent, integrated information for monitoring and oversight of all imported food commodity programs.

Finding 4: Performance Reporting

Regular/systematic reports are not provided to management to monitor performance or support decision making for all food commodity programs. Procedures have not been put in place to ensure that recommendations have been implemented in response to issues or areas identified for improvement from prior audits, internal reviews and self assessments.

Recommendations - Governance

1. The governance structure should be enhanced to assign accountability and provide oversight so that a cohesive, risk-based strategy is used to ensure the CFIA's compliance with legislation, effective risk management and adequate control.

2. A Performance Measurement Framework to monitor and report on all food commodities should be developed and implemented to provide management with regular information for oversight and to ensure achievement of established objectives, outcomes and approved actions from recommended changes. The framework should include performance indicators and targets.

Controls

Finding 5: Resource Management

A changing profile for food imports (e.g. complexity, volume, trade pathways, and risks) combined with staff retention issues and changing work volumes from region-to-region and area-to-area has resulted in resources not always being available to meet planned activities. While manuals for most programs are up-to-date or were being updated, some remain outdated and training is inconsistent across organizational locations and programs.

Finding 6: Compliance and Enforcement Activities

Enforcement policies, procedures and tracking mechanisms are in place and enforcement action is evident. Sampling plans in some programs are partially under-delivered making it difficult to assess to what extent compliance is achieved. Systems to track current compliance and verification activities are not available for all programs.

Finding 7: Operational Controls

Food commodities regulated for trade purposes (i.e. meat, fish and seafood, and egg programs) use a wide range of foreign country, border and destination controls, allowing for a more comprehensive food-safety control framework. For the most part, inspections for these commodities are carried out according to plan. While initial foreign country equivalency assessments were conducted with some countries (e.g. United States), periodic foreign country equivalency audits are only partially delivered and no foreign country equivalency controls are in place for food commodity programs other than meat, fish and seafood, and egg. Imports of other food commodities rely almost exclusively on destination inspections and projects.

Recommendation - Controls

3. Workloads associated with imported food inspections and control activities should be assessed to ensure appropriate allocation of resources to address risks and changing priorities within the food programs.

Risk Management

Finding 8: Agency-Wide Risk Analysis

The CFIA has an integrated risk management policy which sets forth a framework for risk assessment. Imported food safety risks are analyzed as part of the Food Safety Science Committee risk assessment conducted periodically. The results of this risk assessment are used as input to the planning for each food commodity program. An assessment of business risks related to such areas as staffing, legal, systems and reputation is not conducted across the food commodity programs for imported food safety. A documented risk assessment including both scientific and business risks is not prepared for all food commodity programs.

Finding 9: Planning Across Commodities

Each food commodity program plan is created independently. Plans do not use an integrated or consistent Agency-wide approach with a management framework that cuts across individual programs as required by the guiding principles of the CFIA's Import Control Policy. Human or financial resources to deliver planned activities are not included in the plan.

Recommendation - Risk Management

4. Imported food safety risks should be identified and assessed on an Agency-wide basis, and programs planned and delivered in a manner that is risk-based and supports the achievement of CFIA's imported food safety objectives and expected outcomes.

Statement of Assurance

In my professional judgment as Chief Audit Executive, sufficient and appropriate audit procedures have been conducted and evidence gathered to support the accuracy of the opinion provided and contained in this report. The opinion is based on a comparison of the conditions, as they existed at the time, against pre-established audit criteria. The opinion is applicable only to the entities examined and within the scope described herein.

Audit Opinion

In my opinion, CFIA Management of Imported Food Safety has deficiencies that represent multiple areas of risk exposure requiring significant improvements related to the governance, control, and risk management processes.

Peter Everson
Chief Audit Executive,
Canadian Food Inspection Agency

1.0 About the Audit

Entity Background

In recent years, Canada has experienced increased volumes and diversity of imported food:

• The inflation adjusted value of food imported increased approximately 45% in the past 10 years, growing from $14.2 billion in 1997 to $21.8 billion in 2006.
• The number of countries from which Canada imports food products increased from approximately, 143 in 1990 to 193 in 2005; the top ten are: United States, Mexico, China, France, Italy, Brazil, Chile, Thailand, Australia, and the United Kingdom (79 % of Canada's imported food products come from these ten countries).

Imported foods are subject to domestic food safety related requirements (e.g. standards and regulations) once they enter the domestic handling and processing systems. In terms of food safety controls for imported foods, there may be requirements placed on the countries of origin and foreign suppliers to meet Canadian food safety requirements before a product is imported; and when a product enters Canada, border point-of-entry control requirements must be met. Importers or foreign processing establishments for some commodities may be subject to import controls, such as foreign country food inspection program assessment, inspection of foreign establishments, audit of importer quality systems and importer licensing.

The Canadian Food Inspection Agency (CFIA) verifies industry compliance with Federal Acts and Regulations through a number of inspection, sampling and surveillance activities. Within the CFIA, responsibilities are assigned to three branches; Science, Policy and Programs, and Operations. For the border point-of-entry inspection of imported foods, the CFIA works closely with the CBSA.

The CFIA's role in imported food safety is defined by the following Acts: The Food and Drugs Act (FDA); The Consumer Packaging and Labelling Act (CPLA); The Meat Inspection Act (MIA); The Fish Inspection Act (FIA); and The Canada Agricultural Products Act (CAPA). All food sold in Canada is covered by the Food and Drugs Act, which prohibits the manufacture or sale of all dangerous and adulterated food products anywhere in Canada. Some food commodities are also covered by additional commodity specific legislation.

Audit Objective and Scope

Objective

The objective of the audit is to provide assurance to senior management that the CFIA's management of imported food activities comply with appropriate Acts and Regulations, and that they are designed, organized, and delivered in order to achieve food safety objectives.

Following the preliminary assessment for this project, the objective was narrowed to focus only on assessing how the CFIA manages food inspection activities to reduce risks associated with imported foods, including the management control framework in place for imported food safety. Audit work was also carried out to assess the extent to which the CFIA is positioned to manage risk and achieve objectives related to imported foods. The broader objective related to compliance with Acts and Regulations will be conducted as part of future audits of individual food commodity programs.

Scope

The scope of the audit included the food import activities of the Science, Policy and Programs, and Operations Branches of the CFIA. The audit assessed activities related to import controls for all nine food commodity programs: meat, fish and seafood, eggs, dairy, maple, honey, fresh fruits and vegetables, processed products, and products regulated only under the Food and Drugs Act (referred to as non-federally registered products). The CFIA organizes many of its activities around these commodity groupings; grouped according to the legislative and regulatory requirements.

The timeframe covered was April 01, 2005 to March 31, 2008, with documentation and information outside of that timeframe considered if deemed relevant to current management practices. A preliminary survey was conducted for the audit in February 2008. The audit fieldwork was conducted between April and September 2008. The final analysis and reporting completed between January and March 2009.

The activities related to Health Canada's role with respect to setting policies or standards are not in the scope of the work done. Import control arrangements under the Memorandum of Understanding (MOU) between the CFIA and the CBSA were assessed as a separate audit project.

Audit Methodology

Criteria

Audit criteria (see Appendix A) were developed within the framework of the management control elements defined in the Canadian Institute of Chartered Accountants' (CICA) Criteria of Control (CoCo). Specific criteria were drawn from the Office of the Comptroller General's Core Management Controls framework. The frameworks were useful in allowing the assessment of management controls for all imported foods programs and individual branch responsibilities across the CFIA.

Approach

The audit approach included interviews, documentation review and analysis. Interviews were conducted with over 100 CFIA staff and management from Policy and Programs, Operations and Science Branches. The audit included an assessment of the extent to which each of the management control elements (audit criteria) were in place at the corporate level, as well as within each commodity program.

In addition to the observations included in this report, the results of the detailed assessments for each food commodity program are provided to management in the form of management letters. These assessments are provided as part of the commodity program profiles that include: brief program description (identifying the legislative authorities); highlights of business processes; an assessment of key controls; and a summary of key observations and issues raised.

2.0 Findings and Recommendations

Governance

Finding 1: Agency-Wide Strategy Specific to Imported Food Safety

We would expect that there are clear policy objectives for imported food safety activities and that these are well-communicated and understood. Without strategic guidance, the CFIA does not have clarity on the broader program objectives, outcomes and priorities.

The Policy and Program Branch establishes national programs for each major food commodity (e.g. meat and fish). Activities related to imports are integrated into program planning and delivery across the three branches and rely on coordination to ensure food import related requirements are being addressed.

An Import Control Policy was approved by the CFIA Executive Committee in 2002 to guide CFIA's import control activities. A detailed Import Policy Action Plan was subsequently created to implement the policy. To date, this policy remains to be fully implemented and, due to an evolving imports environment, its status as a guiding document for managing food imports is unclear. There are differing and inconsistent views across the CFIA on the relevance and level of application of the Import Control Policy; and it has not been updated since 2002 to reflect changes in imported foods and the CFIA's programs.

The CFIA's Report on Plans and Priorities (RPP) provides a context for the CFIA's direction with regard to food imports as objectives related to imported food are identified and embedded in the Strategic Outcomes. As well, the 2003-2008 CFIA Business Plan provides reference to imported foods. However, a specific Agency-wide strategy for food import control activities has not been formalized and made available such that officials can clearly articulate a consistent Agency-wide view.

Finding 2: Accountability for Strategic Direction

We would expect that authorities, roles, responsibilities and accountability are clearly defined and consistent with CFIA's objectives. Without clear accountability, policy or strategic direction may be misinterpreted leading to undesired variations in program design, implementation and outcomes.

In the Import Control Policy, responsibility for import activities was assigned to all CFIA programs. Roles and responsibilities across the three branches are defined within each food commodity program. Roles and responsibilities appear to be understood and functioning. Inspection and sampling plans for imported foods are prepared by Programs Branch with the Operations and Science Branches held responsible for implementation.

The CFIA Agency Import Coordination Committee (AICC) was established to ensure consistency in the delivery of import programs and to provide a forum for Policy and Programs, and Operations to address key issues with respect to import control. The AICC is not an executive decision-making body and does not provide strategic direction. Committee meetings typically address linkages, relationships and issues with external parties (e.g. CBSA, United States Food and Drug Administration), and internal matters such as resourcing and day-to-day operational issues. The Committee was originally mandated to meet four times per year. In practice, the committee has met on an annual basis.

Currently, overall responsibility for maintaining the policy and providing strategic direction related to imported foods is unclear. While the division of responsibility between policy and planning and program delivery is understood; there remains uncertainty as to where the accountability lies for assessing past performance and making adjustments in future plans.

Finding 3: Information Systems

We would expect that information needs and related information systems should be in place to support the achievement of the food commodity program objectives and that the systems would be reassessed as objectives change or as reporting deficiencies are identified. Information management systems and reporting that are not well conceived and implemented create a risk to effective oversight and to an organization's ability to delivery on its objectives and priorities.

Imported food related information systems for the Meat, Fish and Seafood, and Egg programs are integrated and provide tracking and control mechanisms. The Fish and Seafood program have also implemented a system and tool set to provide management information. A project has begun to define business requirements to enhance the interface systems with the CBSA, although a decision to undertake the systems development work has not been taken. The data transfer interface from CBSA systems to the Import Control and Tracking System for Meat, Fish and Seafood, and Egg programs is not automated requiring considerable effort to renter data. Canadian agricultural product programs other than the Egg program rely on the Import Retrieval System (IRS), a weekly data transfer from CBSA, and ad hoc tools. Not all non-federally registered products can be identified as the IRS does not provide adequate detail to report on specific products (i.e. not all available data is transferred). A strategic plan for development of information systems related to imported food and food commodity programs has not been developed.

The link between inspection activities and outcomes is unclear in the current performance management and accountability framework. Clear direction on the information needed for effective oversight and control of food import-related activities has yet to be defined for most programs. While information related to imported foods is available from a number of sources, a formal means of reporting on internal operations that affect delivery of the program and achievement of import-related objectives is not readily available.

Finding 4: Performance Reporting

We would expect that performance should be monitored against indicators and targets identified in the organization's objectives and plans and that follow-up procedures would be established and performed to ensure appropriate actions or change occurs. Without adequate systematic performance reporting, senior management may have insufficient information to assess the extent to which CFIA is on track to meet program objectives and outcomes, to understand the risks posed by imported foods and to ensure program design and delivery adjustments are made over time.

Senior management does not receive systematic or regular reports on the performance, outcomes, or results of import control activities. The type of performance information gathered, maintained, and assessed varies from Area-to-Area and Region-to-Region, and the information that is compiled is not being analysed to assess the effectiveness of program delivery or management controls. Management reports tend to focus on urgent priorities, with information (such as, trends or details of food imports) to support management decision-making not as readily available.

The CFIA has a Performance Management Framework (PMF) system in place. Some import related performance data is integrated into the Agency-wide monitoring systems and import specific performance data is available (for example: imports and domestic data for complaints, recalls, projects, sampling plans). Quarterly and annual Management Resources and Results Structure (MRRS) variance reports are created in each area. There was no indication that senior management are assessing the information contained in the MRRS reports to revise, adjust, or amend the current import controls.

A number of reviews, audits and self assessments have recommended areas where adjustments are required in the organization's legislative, policy, program and operations framework related to food imports. Management actions developed in response to these recommendations have not been fully implemented. A review of the recommendations found that only 10-15% of the recommendations relevant to imports have been implemented. No formal or documented procedures are in place to ensure that recommendation have been implemented in response to issues or areas identified for improvement from prior audits, internal reviews and self assessments.

Recommendations - Governance

1. The governance structure should be enhanced to assign accountability and provide oversight so that a cohesive, risk-based strategy is used to ensure the CFIA's compliance with legislation, effective risk management and adequate control.

2. A Performance Measurement Framework to monitor and report on all food commodities should be developed and implemented to provide management with regular information for oversight and to ensure achievement of established objectives, outcomes and approved actions from recommended changes. The framework should include performance indicators and targets.

Controls

Finding 5: Resource Management

We would expect that people should have the necessary knowledge, skills and tools to support the achievement of the CFIA's objectives. Failing to adjusting inspection staff resources across programs, organizational units and locations in response to the changing profile and risks associated with food imports may result in uneven or inefficient workload distribution, inadequate alignment of changing priorities, and increased risk that resources are not available and adequately trained to meet inspection, sampling and testing requirements.

The changing profile of imported foods (e.g. complexity, volume, trade pathways, and risks) and issues related to retention of staff are creating organizational and staffing challenges. Staff resources have not been re-allocated over time to address changing import priorities, leading to difficulty in providing sufficient staff resources where significant increases in import related workloads have occurred. Workload increases were particularly evident in the Toronto Region. Additionally, staff resources are reassigned from planned activities to initiate a recall or to deal with other food safety issues putting additional pressure on delivery of work plans.

The CFIA has chosen a 'train-the-trainer' approach for human resources development. Area inspectors are provided with the training identified in the CFIA's National Training Initiatives (NTI) Process. The approach, as implemented, is less effective than anticipated. Staff suggested that high turnover rate and presentation skills of "trainers" impact the effectiveness of the program. Consistent, comprehensive training was not evident in all programs particularly where higher work pressures exist.

Tools (e.g. Automated Import Reference System-AIRS, inspection manuals, and internal procedures) are in place to deliver the CFIA import activities. The AIRS provides an accessible reference of the CFIA's inspection requirements for producers, importers, inspectors, Border Services Officers, industry associations and other interested parties. Procedures in non-federally registered and some Agrifood Programs were not as clearly defined or up-to-date. Information management systems are discussed in a separate finding.

Finding 6: Compliance and Enforcement Activities

We would expect that the safety of imported food is effectively monitored and enforced when non-compliance is identified. Limitations in implementing compliance and enforcement protocols increase the risk of not achieving the organization's primary food safety goals and objectives. Incomplete compliance and verification activity information may hamper the CFIA's ability to demonstrate achievement against its performance targets and to adjust ineffective compliance and verification protocols.

The annual plan for each food commodity program identifies monitoring requirements to assess compliance for both domestic and imported foods. The plans include activities related to inspection, sampling and labelling, and are developed on the basis of the risks identified through the Food Safety Science Committee risk assessment process. This includes consideration of the history of the food commodity's non-compliance, whether the commodity is new to the Canadian market and the compiled inspection data history for the product.

The regulatory authority for imported non-federally registered products is limited. Food commodities regulated for trade purposes (meat, fish and seafood, eggs, maple, dairy, processed products, and fresh fruit and vegetables) allow for a more rigorous food-safety framework.

At the operational level, inspections are planned and carried out in an effective and efficient manner for registered food commodities. There is difficulty in obtaining samples for non-federally registered products and Fresh Fruits and Vegetables. The conversion of import manifests to electronic documents has made it difficult for inspectors to locate shipping destinations for some products, particularly Processed Products and Fresh Fruits and Vegetables.

A reactive approach to emergency-based management - the Food Safety Investigation and Recall Process - is in place. The process defines the risk management options that may be implemented to deal with a food safety incident. In addition to recall, inspectors can use detention, seizure, public advisories, warning letters, formal hearings, informal meetings, deregistration, prosecution, border lookouts, or re-export of the affected product(s).

Enforcement and Investigation Services (EIS) tracks and reports on all enforcement activities. Policies and procedures are in place to provide direction on how to deal with non-compliance, including recall and removal of products. However, senior management does not receive regular reports on the status of compliance and enforcement activities. There were no reports provided that analyze the data and describe how well the compliance and enforcement activities are being implemented.

Finding 7: Operational Controls

We would expect that control activities should be designed as an integral part of the organization, taking into consideration its objectives, the risk to their achievement, and the interrelatedness of control elements. The inconsistent application of controls may increase the risk that the CFIA's imported food safety activities will not result in the achievement of the fundamental food safety goals and objectives of the organization.

According to the Import Control Policy, greater emphasis was to be placed on foreign country equivalency assessments and audits to reduce dependence on downstream controls (e.g. for border point-of-entry or destination controls). Foreign country equivalency involves an assessment of export country food safety programs to determine their equivalency to Canadian requirements. Periodic audits verify ongoing compliance. For the fish and seafood program, the Quality Management Program for Importers (QMPI) is used to manage the quality of imported products, including information on foreign country controls. The planned periodic equivalency and QMPI audits are under-delivered. As well, there has been limited progress in expanding equivalency controls across other food commodity programs. Memorandums of Understanding and Mutual Recognition Agreements with other countries allow the conduct of equivalency assessments and audits. Most have not been updated in 5 to 15 years.

Border point-of-entry controls provide effective entry decisions and stop non-compliant regulated commodities before they enter Canada. The level of import point-of-entry control varies across the food commodity programs. Data and information to support decisions related to product inspection activities for imports are primarily provided through import declaration data. There has been a lack of coordination related to the need for systematic receipt of import declarations data and information. For regulated products, the information provide by CBSA is manually keyed to the Import Control and Tracking System (ICTS). For those food commodities not tracked in the ICTS, the IRS maintains declaration data transferred from CBSA. However, this data is received one to two weeks after the arrival of shipments meaning it is of limited use for tacking and controlling imports.

Destination inspection programs provide risk-based inspection activities that target food commodities. The required level of inspection is determined by food commodity programs, and includes defined sampling frequencies and inspection activities. The food commodity program plans are converted by Operations Branch into regional work plans based on the availability of operational resources. The revision of work plans to accommodate operational resourcing may alter the intent of the food commodity program plans. Non-federally registered products rely on inspection and sampling projects to draw conclusions on the safety of food products. Projects such as for bakery products may take multiple years to deliver due to the availability of resourcing to conduct inspections.

The Import Control Policy identified a number of new technologies that could be used to achieve more efficient and effective import control. Examples include: communication tools, licensing of importers, registration of regulated commodities, informatics, inspection methods and procedures, and fast testing tools. Importer licensing, registration of regulated commodities, or new inspection methods have yet to be adopted.

Recommendation - Controls

3. Workloads associated with imported food inspections and control activities should be assessed to ensure appropriate allocation of resources to address risks and changing priorities within the food programs.

Risk Management

Finding 8: Agency-Wide Risk Analysis

We expected that the CFIA would identify and assess the significant internal and external risks faced in the achievement of its objectives. Failing to identify and assess risks to the achievement of CFIA's objectives for imported food safety on food commodity-by-commodity basis and across food commodities may lead to redundant or insufficient risk mitigation strategies. This may also lead to inefficiencies and possibly unacceptable levels of risk.

The CFIA has an Integrated Risk Management policy which sets forth a framework for risk assessment and a CFIA wide Risk Profile that identifies risks from a corporate perspective. The corporate risk profile provides a risk framework in which the food commodity programs can assess imported food related risks.

An assessment risks for food commodity programs are carried out through the Food Safety Science Committee risk assessment process based on Food Safety Risk Analysis - A Guide for National Food Safety Authorities prepared by the Food and Agriculture Organization of the World Health Organization (WHO). This process is focussed on identifying the risks associated with specific food issue areas. These risk assessments were completed in November 2004 with an update initiated in February 2008.

Other internal and external sources are also used to identify risks associated with imported food safety including information from program operations, other countries, and food safety related organizations (e.g. WHO). With the exception of the Fish and Seafood program, no documented Environmental Scanning activities were identified within the CFIA's food programs.

The current risk assessment methodology used by the food commodity programs does not take into consideration the business risks to the program. Such considerations as succession planning, priorities of trade versus food safety, and the changing volume of products entering the country from one area to another among others will affect strategic direction, work priorities and controls within and across food commodity programs. The ability to assess these risks across food commodity programs is also hindered by a lack of consistent documentation for review by oversight bodies and other food commodity programs. A number of previous studies identified the need for more consistent assessment of risks across national programs and food safety issue areas.

Finding 9: Planning Across Commodities

We would expect that plans to guide efforts in achieving the CFIA's objectives should be established and communicated and that objectives and related plans should include measurable performance targets and indicators. Without a co-ordinated and consistent planning effort across food commodity programs, there is an increased risk of inconsistency in approach and planned activities may not be clearly aligned with the CFIA risk-based priorities and strategic objectives and outcomes. Without adequate resource budgeting, plans may not clearly link the financial and human resources required to deliver the activities.

The Policy and Programs Branch (PPB) has overall responsibility for developing an annual plan for each food commodity program. Management and staff of all three Branches expressed the view that the current planning process is not working as intended, and that further work is required to align the proposed level of effort with the level of financial and human resources.

Each food commodity program currently develops their own plan, all differing in form and content, creating a challenge in assessing how well efforts have been integrated and coordinated across national programs. Planned sampling and inspection activities (i.e. the list of products targeted) are not always adjusted from year-to-year to reflect changes in risks and priorities. Sampling plans are developed in accordance with CODEX requirements, and the requirements often exceed the capacity to deliver.

Responsibility for implementation of all individual food program plans rests with the Operations and Science Branches. Concerns were expressed by Operations Branch managers that some of the annual sampling plans were not received in a timely manner and were not reflective of the import profile of the Area to which it applies.

National program plans are not tied to Human Resources (HR) and financial plans or the budget allocation process. National program plans include inspection and sampling requirements for the program, with the level of effort and associated plan costs to budgets left unstated. It is unclear what the HR and financial implications of the plans might be and the ability to assess the incremental resourcing requirements for plans that are not delivered is limited.

Recommendation - Risk Management

4. Imported food safety risks should be identified and assessed on an Agency-wide basis, and programs planned and delivered in a manner that is risk-based and supports the achievement of CFIA's imported food safety objectives and expected outcomes.

Appendix A: Audit Criteria Guidance

Purpose

• A1 - Objectives should be established and communicated.
• A2 - The significant internal and external risks faced by an organization in the achievement of its objectives should be identified and assessed.
• A3 - Policies designed to support the achievement of an organization's objectives and the management of its risks should be established, communicated and practised so that people understand what is expected of them and the scope of their freedom to act.
• A4 - Plans to guide efforts in achieving the organization's objectives should be established and communicated.
• A5 - Objectives and related plans should include measurable performance targets and indicators.

Commitment

• B1 - Shared ethical values, including integrity, should be established, communicated and practised throughout the organization.
• B2 - Human resource policies and practices should be consistent with an organization's ethical values and with the achievement of its objectives.
• B3 - Authority, responsibility and accountability should be clearly defined and consistent with an organization's objectives so that decisions and action are taken by the appropriate people.
• B4 - An atmosphere of mutual trust should be fostered to support the flow of information between people and their effective performance toward achieving the organization's objectives.

Capability

• C1 - People should have the necessary knowledge, skills and tools to support the achievement of the organization's objectives.
• C2 - Communication processes should support the organization's values and the achievement of its objectives.
• C3 - Sufficient and relevant information should be identified and communicated in a timely manner to enable people to perform their assigned responsibilities.
• C4 - The decisions and actions of different parts of the organization should be coordinated.
• C5 - Control activities should be designed as an integral part of the organization, taking into consideration its objectives, the risks to their achievement, and the inter-relatedness of control elements.

Monitoring and Learning

• D1 - External and internal environments should be monitored to obtain information that may signal a need to re-evaluate the organization's objectives or control.
• D2 - Performance should be monitored against the targets and indicators identified in the organization's objectives and plans.
• D3 - The assumptions behind an organization's objectives should be periodically challenged.
• D4 - Information needs and related information systems should be reassessed as objectives change or as reporting deficiencies are identified.
• D5 - Follow-up procedures should be established and performed to ensure appropriate change or action occurs.
• D6 - Management should periodically assess the effectiveness of control in its organization and communicate the results to those to whom it is accountable.

Appendix B: Management Response and Action Plan

Management Response:

The management of Policy and Programs (PPB), Operations (Ops) and Science branches have committed to jointly prepare the attached Action Plan to address the Recommendations put forward in this Audit Report. PPB, in collaboration with Operations Branch, will track progress on the Action Plan items and provide status reports to the Audit Committee on a biannual basis.

The CFIA accepts the recommendations contained in this report. We are committed to improving our import control systems so that Canadians continue to enjoy safe imported foods.

Since the creation of the Agency in 1997, imports and exports of products subject to the CFIA regulations have increased by 45.6 per cent. Global supply chains have fundamentally changed. Ingredients are sourced worldwide and finished products are globally distributed, amplifying the potential scope and impact of failures in food safety control systems.

The CFIA sets its priorities for action based on food safety risks. The Government of Canada has recognized the need to strengthen imported food control systems. To this end, it has allocated $223 million over five years and $53 million per year thereafter to the CFIA under the Food and Consumer Safety Action Plan (FCSAP). The CFIA has just completed year two of the Food Safety Action Plan project, under the FSCAP. Once completed in year five, the CFIA will have:

• reviewed its existing Import Control Policy to ensure its principles and objectives remain relevant;
• put in place tools (e.g. data collection, risk mapping, etc) to better identify importers, and track imported products;
• enhanced capacity to monitor risks to Canadians and prevent unsafe products from entering the marketplace; and,
• completed discussions with key trading partners on approaches to managing high-risk source countries.

In addition, the CFIA has already introduced a strengthened import program for fish and seafood products, enhanced tools for identifying imported products, conducted border blitzes, formed an import surveillance team, and is developing a licensing scheme for importers of agricultural products.

Audit Recommendation

Governance:

1. The governance structure should be enhanced to assign accountability and provide oversight so that a cohesive, risk-based strategy is used to ensure compliance with legislation, effective risk management and adequate control.

Governance:

2. A Performance Measurement Framework to monitor and report on all food commodities should be developed and implemented to provide management with regular information for oversight and to ensure achievement of established objectives, outcomes and approved actions from recommended changes. The framework should include performance indicators and targets.

Controls:

3. Workloads associated with imported food inspections and control activities should be assessed to ensure appropriate allocation of resources to address risks and changing priorities within the food programs.

Risk Management:

4. Imported food safety risks should be identified and assessed on an Agency-wide basis; and programs planned and delivered in a manner that is risk-based and supports the achievement of CFIA's imported food safety objectives and expected outcomes.