How do regulators and large retailers assess suppliers? What are the key compliance factors businesses must meet to ensure food safety, quality, and long-term partnerships?

In this 35-minute webinar, we explore the rapidly evolving food safety regulatory landscape with Andrew Wilson. With over 13 years of experience in food safety regulation, Andrew brings a deep understanding of compliance verification, risk management, and emerging regulatory models. The webinar will include a discussion on key aspects of compliance assessment, common compliance issues, and how organisational culture and data-driven risk management can influence these. We will also touch on the potential future needs and roles of food safety regulators, along with how industry can prepare to participate in shaping these.

This covers:

1. Regulatory role and purpose are different from commercial audits – in scope, depth, and purpose (legal obligation vs. voluntary standard).
2. Using your evidence/data to demonstrate compliance and strengthen food safety culture via feedback and continuous improvement, both internally within your business and externally to customers/regulators, etc.
3. Being able to “tell a story” to illustrate examples using the data that you have, and sharing these stories to strengthen food safety culture, influence human behaviours (from both an industry and a regulatory perspective) to increase performance.

Guest:

Andrew Wilson 

Core Team Member – Cultivate SA / Principal – RiskMinds Pty Ltd

Dr Andrew Wilson is a Core Team Member at Cultivate SA and Principal at RiskMinds Pty Ltd. He is a former Australian food safety regulator with more than 15 years of experience, specializing in contemporary regulatory policy development and implementation, particularly integrating technology-enabled solutions. With a career spanning both strategic policy and practical regulatory operations, he has deep experience in regulating food safety systems to support domestic and export market access requirements across multiple commodity groups, including meat, dairy, seafood, eggs, and horticulture.

A unique aspect of Andrew’s approach is his focus on social sciences, including organizational culture and human behaviors that support both compliance and strategic outcomes. He has been a proponent of incorporating behavioral science techniques into regulatory practice, recognizing the importance of understanding cultural dynamics and mindsets in combination with data analytics to shape effective food safety and public health risk management.

---

Below is the full transcript:

How Large Retailers & Regulators Evaluate Suppliers

[00:00:00] Cronan McNamara: I’m here with Dr. Andrew Wilson, who’s a core member of Cultivate SA and the principal at RiskMinds. He’s a former Australian food safety regulator with more than 15 years of experience specializing in regulatory policy development and implementation, particularly integrating technology-enabled solutions.

I think what particularly fascinates me is your interest in organizational culture and human behavior, Andrew, which helps support both compliance and other strategic outcomes. I think I’m a big believer in. You bring a really strong understanding of that aspect of cultural dynamics and mindsets, and from combining that with data analytics to shape effective food safety and public health risk management, I think it’s gonna be a key topic for us today.

Thanks for joining us, Andrew. How are you?

[00:00:55] Andrew Wilson: I’m well, thank you, Cronan, and thank you for the opportunity to join you. It’s a topic that’s very close to my heart, so thank you. I very much appreciate the opportunity.

[00:01:05] Cronan McNamara: Pleasure.

Regulator vs. Industry: Compliance Perspectives

So this is the second part in this series on this topic, ‘How retailers, buyers and regulators evaluate suppliers in terms of food safety’. So we had a great conversation with Sara Mortimer in the last session where she was on the, industry side, obviously as a buyer for Walmart and her work in industry, she’s a lot vast experience of how to try to evaluate suppliers and providers and manufacturers of food and ingredients for her commercial companies.

And we went into a lot of discussion on that, and you know how they’re using data. How certification plays a part, but it’s just a starting point. And then the kind of concept of a walk around talking to people about capability and culture in the, and to try to get a sense of that, but that’s not necessarily scalable as a buyer with tens of thousands of probably suppliers or as a regulator with tens of thousands of organizations you need to regulate. So I’m interested in finding out more about your thoughts on how you know regulators assess compliance around suppliers, foods, food suppliers in particular, food manufacturers, even food service and retailers. So let’s kick off, I guess, with that. How do regulators assess supplier compliance and conformity with rules and regulations?

[00:02:38] Andrew Wilson: I think that’s a very broad question because it has a lot of variability depending on where you are in the world to start with. So I guess I’ll firstly give myself a disclaimer to say that a lot of my experience is generally based in the Australian environment, but is relatively transferable to most other well-developed nations with solid food safety systems.

I think the first thing to state upfront is that the clear difference between a regulatory role and a commercial role is that, ultimately, a regulator is looking at a standard that is compulsory. All businesses must comply with that standard. And it is the lowest common denominator, if you like, that all businesses must meet in order to be operational.

There are various tools to manage those businesses that are noncompliant, depending on things that are in place around, with whether it’s that serious seriousness of noncompliance. But at the end of the day, fundamentally, we’re looking at that legal basis to operate.

In terms of what we look at and how we look at those things, there are various methods that regulators use. Most people will be familiar with things like inspections or audits. Regulators use a number of tools to assess compliance that are based on the minimum standards that are required to be met.

But ultimately. It’s not just about filling out a checklist for regulators, it’s about the behavior of the business. We wanna see what the business is going to do when the regulator is not in the room. So for us, it becomes a real focus on risk and behavior as a result of that.

So, a lot of onus and a lot more attention these days is being paid by regulators to the culture of a business. In that regard, how do businesses manage those food safety risks? How do they raise them, and how do they identify them? And then how do they act on them to ensure that they’re managed in a sustainable way?

Evaluating Beyond Compliance

[00:04:43] Cronan McNamara: The fascinating thing, I think, is that they are, there are these compulsory, as you call them, lowest common denominator requirements that are just absolutely mandatory to stay in business. And you’re checking that, but a lot of companies on their own basis would like to be, have standards well above that, so that they’re providing that quality and safety and reassurance to their buyers and the customers out there that the consumers.

Tell me about like how you might evaluate that, how they’re going above and beyond, those basic, absolutely necessary requirements that the regulations would have in place, and what role does a regulator have in evaluating that sense? Essentially.

[00:05:26] Andrew Wilson: I think that you bring up a good point, and ultimately from a regulatory perspective, you’re either, as I said before, one of two states compliant or not.

Yeah. It’s difficult to be evaluated as greater than compliant, given the nature and the legality around what the regulatory job is. But there are. A number of regulators, including a regulator that I used to work with in Victoria, in Queensland, and a couple in Australia, including one in Queensland that have started to recognize these behavioral aspects of a business.

And look at how they sustain compliance in the longer term. Really, those are set on models that are regulatory models that are truly risk-based. So I guess you can’t have any sort of recognition above that binary compliance or non-compliance state, unless you have a truly risk-based regulatory framework to start with.

Using Data and Risk-Based Approaches

[00:06:23] Cronan McNamara: Exactly. So, if you can evaluate the risk of a portfolio, a large portfolio of manufacturers and suppliers in the marketplace, can you use data to try to risk rank those in a sense, so that you can prioritize more intensive or more frequent? Reviews or audits on the ones you thought you feel would have a higher risk?

Is that something you would’ve done or something that’s emerging in the regulatory environment?

[00:06:53] Andrew Wilson: Yeah, I think it’s fair to say from the outset that regulators, whether you’re working in food safety or any other regulatory scheme, are facing multiple challenges moving forward. If you wanna focus on food safety for a moment, we’ve got a sector in AgriFood globally, which is growing at a rate that we’ve never seen before.

We’ve got increasing investment in that sector. With food security being a question and global trade is really driving that investment. On the other hand, we’ve got restrictions on regulatory resources. So we’ve got restricted budgets. We, regulators in general, do have challenges with attracting and retaining staff, for example.

We see budget cuts that are happening, and the geopolitical environment around the regulatory schemes globally is causing those resource bases to rapidly contract. But on the other hand, again, we’ve got a public expectation that there is a regulatory assurance that’s stronger as well.

So really, in terms of what you are referring to, we need to be able to, as regulators moving forward, look at how we evaluate businesses and really focus from a regulatory perspective on what the risk that an individual business holds in and of itself. What can we assess and gather in terms of information to.

Give weight to where we are assessing them and give transparency and accountability around those actions. And how can we then measure the effect of those and demonstrate it back to our stakeholders, particularly in government and the public, that we are being effective? And all of those things show that we’ve got a good regulatory culture as well.

There’s a rising concept of this, of regulatory culture. Whereby all of these things are around regulatory risk as well. So remember, we’re not just talking necessarily about food safety risk, but as a regulator, you have legal requirements that you must cover off.

You must make sure that you manage those risks also.

[00:09:00] Cronan McNamara: It’s a challenging environment, as you say, with an expectation of food safety by the public. But a lack of resources or unwillingness to increase resources, at least, and perhaps shrinking resources. So I guess the opportunity to use more data and technology to help really zone in on priority areas is going to be essential in that environment, as you’re mentioning.

So, a question from Michael McDonald. Thanks for your question. Regulation and, more importantly, enforcement play an enormous role in the food safety ecosystem. How can industry and regulators collaborate better to raise standards and bring the food industry forward, whether for a small, medium, or large food operator?

Collaboration Between Industry and Regulators

[00:09:50] Andrew Wilson: I think there’s a big piece that transparency and consistency, and accountability play in this conversation.

Ultimately, regulators need to be. Very upfront with the industries they regulate as to how they’re going to treat businesses when they see certain circumstances appear and stick to those undertakings and be accountable to that. I think that, in terms of enforcement action or certainly dealing with non-compliance businesses must know where the line sits between, the regulator giving a little bit of rope for the business to take corrective action or moving to the next stage where the regulator and the business work hand in glove to manage the situation or at the extreme, take that permission away from the business to operate so that they can manage to protect public health.

So, in terms of the very first start, I always say that engagement is a key to many of these things. I think the fundamental principle is that we all want the same thing, which is safe, consistent, sustainable, and profitable food supply chains. And that, the sooner we get on the same side of the table around that and engage around that to say, Hey, we can tell you a story about how we as a regulator will operate.

Can you tell us a story about how you, as a business, operate, and look at the Venn diagram of where those interests overlap? And in this case, particularly with respect to things like data, it comes back again to behavior. We know how each of those parties is going to behave, and we can be held accountable for those actions, both legally and from a procedural point of view.

[00:11:29] Cronan McNamara: I’m curious about the work you’re doing now with Cultivate and RiskMinds. How are you working with companies to help them on that journey? You mentioned behavior and culture, and values, and I think they’re all related. Behaviors are a concrete manifestation of the values and culture of a company.

And you can observe behaviors. And I know that you’re big into trying to help companies with the culture of food safety. Could you talk a bit about the work you’re doing there to as in your current role, to help companies and as a byproduct? Regulators, I guess, as well, to improve food?

Yeah, definitely food safety.

Cultivating a Food Safety Culture

[00:12:05] Andrew Wilson: So I think there’s the, with Cultivate SA we’ve have a couple of food safety cultural maturity models that for both, for manufacturing businesses, for retail businesses, and also for regulatory organizations that talk about a really, some of the key focus areas and that we need to have in businesses that are more mature.

What that means is that. There are elements like how we use data to influence behavior and ultimately be able to demonstrate that, as a mature. Business or regulator, we are able to identify, act on and manage those risks that come up in a proactive way.

As I said before, ultimately, regulators want to be able to hear a story from a business when something happens.

How have you identified that issue? How are you then? Behaviors to manage it. How has it protected the integrity and the safety of your final product?

And then how have you gone back to review that process and improve performance? We talk about that continuous improvement loop both in food manufacturing businesses, but really, that is a key element of any of those cultural maturity models. And ultimately, it does come down to behavior in all aspects.

As I said before, my personal interest in this really came to the fore when I was working in regulatory authority. And I was looking at how businesses implement their food safety systems. So you could have businesses that had fantastic food safety control systems, very professionally presented, three or four folders deep on the shelf.

But it didn’t matter how technically good that test program was, or it all came down to how well they were implementing that in the plant, and how well those people who were given the responsibility to manage the risks around food safety were able to do so from a practical perspective. And that, that came back to what Sara was saying, watching the behaviors of people in the plant.

Implementation vs. Documentation

[00:14:13] Cronan McNamara: Excellent. Yeah, I think that’s where the rubber hits the road, and it’s very progressive for a regulator to go beyond ticking a box and really try to understand that. So I find that very interesting. So let’s move on. Maybe talk a little bit about quality, fraud, and shelf life.

We’ve done a lot of work on food integrity with a group called fiin where industry is sharing data anonymously, and we’re able to aggregate that information on food integrity and issues that arise in the supply chain anywhere in the world. And by sharing those insights, it can help companies prioritize their own audits and risk evaluation of their own suppliers.

So that’s been a very successful data sharing initiative where industries collaborated and now are collaborating with government and regulators as well to share those insights, to really help everyone understand for everyone’s benefit where those weaknesses are in the supply chain. And potential issues around fraud, which can lead to food safety.

Not always, but some, a lot of times, it can. So, in terms of food fraud risk, what are the biggest food fraud risks? That you know of, maybe that regulators are currently monitoring, or have you come across in the past that were impactful?

Tackling Food Fraud through Data Sharing

[00:15:27] Andrew Wilson: Food fraud’s an interesting space. And it’s certainly one of those areas that is rising rapidly.

I think that from a regulatory perspective, we look at it. Under traceability requirements. Do you know where the products come from? What evidence do you have to demonstrate that the product is, and maintains its integrity through that process? And yeah, I think that as a concept, we are focusing more and more on it. I think the point that I take away though, from what you’re saying is that the power of collective data in these areas is really able to shape behaviors, and being able to aggregate that information across an industry and or a sector and feed that back gives businesses an opportunity or in fact, actors, whether they’re regulators or businesses or both, the opportunity to consider those risks from their own perspective.

If you could take us back to the food safety point for a second, there was, there’s been some very nice instances of regulators having that oversight.

And regulators do have a unique perspective insofar as they are the only neutral body available that has oversight of all businesses that operate within their jurisdiction. And as such, have the ability to actually extract those insights and feed back to businesses or industries collectively to shape the way they behave.

So in the instance where we have rising food fraud risks, it’s about being able to bring that information together to take that back again. Through an engagement channel to industry and say, Hey guys, let’s have a look at this and do some work around this, whether it’s surveillance work or, strengthening up our systems be and do that collectively before it becomes a significant issue of either non-compliance or worse.

[00:17:15] Cronan McNamara: Yeah, exactly. So I think what the fiin Network has done is that the industry has got together to create that insight and share that knowledge, which is a very interesting aspect. And then it brought government regulators in later.

I’ve a challenging question here, and it’s something I think about a little bit, around clean label trends, which are desirable, I suppose from a marketing and a consumer’s point of view, but also potentially conflicting with food safety and often and and even shelf life. So what I’m saying there is, removing certain additives or preservatives from a food might look good in terms of clean label and no added preservatives or whatever, but even upgrading the packaging and taking away plastic and instead using some kind of organic cardboard or other material.

On the one side, that’s good for clean label and environmental sustainability, perhaps, but then on the other hand, it can raise issues of shelf life or quality, or even food safety.

What are your thoughts on the challenges there?

Balancing Clean Label and Food Safety

[00:18:22] Andrew Wilson: It depends on what jurisdiction you’re operating in. We’re lucky enough in Australia to generally work on outcomes-based regulations. So, effectively in Australia, we flip that requirement on its head and say, you must demonstrate that packaging is safe and suitable for the product in which it’s packaged.

So that’s a huge benefit for us. I think that when you get to more prescriptive regulatory standards. Then the challenge becomes, how do you go to the regulator or your standard-setting body, whoever that might be, with a compelling argument? And it does come back to what evidence, what story can you tell around that?

And how does it meet what the regulator is requiring? There are lots of levers you can try and pull. But, and I think variously, you’re gonna get different answers again depending on the political nature of the day and the regime under which you are being regulated.

But. I guess at a high level, the best rule is being able to tell that story with the evidence of data that you have to demonstrate that your product is not a greater risk or is actually an improvement in respect to food safety. And ultimately again. As I said before, the lowest common denominator has to be the legal requirements.

So things like removal of ingredients, for example, or additives on labels as a commercial requirement from a customer just don’t float with a regulator. If that’s what’s required, and ultimately the regulatory response will be to issue a non-compliance in that regard, or should be at least.

[00:19:53] Cronan McNamara: Exactly. So when you say evidence, we’ve come across a number of, cases where the only evidence that’s acceptable is literally a public scientific publication, or it’s desirable to have a scientific publication, obviously over just data or a white paper or something else.

So that can take time. Indeed. But for sure, I think it’s. Good. Science is always a good, the best way to go in terms of trying to innovate, but also maintain the performance of food in terms of safety on shelf life. Let’s move on to that. That’s a great discussion on that. Finally, perhaps let’s look to the future a little bit, or even the present.

We’re looking at incredible advances in AI in the last number of years, in a short number of years. The capability of these large language models to ingest massive data and understand it, and help us to distill it and analyze it, and perhaps come up with even ideas from the data.

How do you feel AI and data are being used in terms of regulation and compliance? Are we making the most of it as, as an industry and regulatory system, or what could we do more of on data and AI to help this, help do this better?

The Role of AI and Automation in Regulation

[00:21:11] Andrew Wilson: I think the rise of AI and its influence in regulation and government spheres more broadly is unstoppable.

It’s going to happen at some point for everybody. And I think that there are definitely benefits in being able to, for example, consume large amounts of data and provide insights from that information. But at the end of the day, from my perspective, and I’ve done a little bit of work with some of these tools, I think that things like decisions and the way that they drive regulatory behavior on.

The backside needs to be ultimately a human decision. Yeah. We can’t remove people from the process in this regard because there’s always going to be validation and verification that needs to occur for these models. And, relying on them solely is a recipe for disaster.

Then, there have been a couple of instances where the automated models have caused some issues. If you wanna have a look into the Australian Robodebt issue, then there was a big issue behind that, not necessarily AI, but it was about automated systems that caused some very big problems.

So ultimately, things like decisions must be justifiable. Regulators must be held to account for those decisions and be able to support them with evidence. That’s good regulatory culture and best regulatory practice. And I think that using these tools is certainly going to help.

But there must always be a person to review those decisions or those recommendations that are made. And certainly things like automation could, can assist when it comes down to the administrivia in government, when, you know, things like processing forms or automation of things that are very well and truly set.

Having gone through a small digital transformation in an agency myself, it was really about looking at what those processes within that agency could be automated. Things like a license application, for example, is a key a key sort of regulatory system that can be automated at the front end, and you can use AI to help with decision making around whether this person needs.

A farm license or a manufacturing license, or a transporter license, because some very basic decisions are involved around that. But when it comes to things like deciding whether someone’s a fit and proper person to hold a license or making decisions that have legal weight, then they are a recommendation.

Sure. But a decision, no, it needs to be a human thing.

[00:23:40] Cronan McNamara: Yeah, I totally agree. I think these AI tools are powerful, no matter what you’re using them for, whether it’s research or writing code, or doing whatever you’re doing as a professional, you’re ultimately the one who has to submit that report or stand over it.

So you do need somebody at the top who’s judging the results of the analytics or the AI. But it can bring great power in terms of efficiency, perhaps. Horizon scanning, risk prioritization, but obviously, you need to have a safety net safety check there with people reviewing that and perhaps even overriding it as appropriate.

And we’re just coming up on time. There are a couple of questions that I see. One here from Dermot Riley, who’s a very innovative person in the food industry that I’ve known for many years. And he’s asking about:

Considering regulators are looking to collaborate with the food sector. How can we better integrate emerging innovations into risk management strategies?

And this is interesting because obviously innovation moves fast, but perhaps the regulatory machine can be slow and requires more robust evidence, like I was saying, perhaps even scientific papers, which can take time. For example, barcodes took time to be used, but perhaps that was more just an industry issue.

But then there are more, there are interesting things that I know that Dermot’s been working on, like nanotechnology, service coatings, and even alcohol-based coatings, which are very effective against pathogens. But at the same time, they seem to be niche in there. I suppose how can these kinds of innovative technologies get more acceptance more quickly if they are effective? How can we accelerate that?

Accelerating Innovation with Regulatory Sandboxes

[00:25:22] Andrew Wilson: I think engaging the regulator from day one is important, right? And being able to ensure that they’re on the journey with you as opposed to being hit at the end with a large amount of data.

I can speak from my own experience in that respect. When novel technologies come forward that, being involved from day one at least, with an awareness, and generally speaking, governments and regulators are bound by the usual sort of non-disclosure arrangements that are in place for commercial arrangements as well.

Just starting at the very beginning with them to say, this is what we’re trying to achieve. Here are the steps we’re going through. What sort of information are you going to need to ensure that we are maintaining food safety at the level that you expect? And, having that conversation said nice and early, and keeping them up to date on that.

I think the other thing for regulators, too, on the other side, is that from a regulatory culture perspective, when you’re looking to always continually improve and be agile, you have to have the ability to set up what I’ll refer to as a regulatory sandbox. So, how do we actually create some sort of alternative arrangement that has all the standard regulatory controls in place?

So you know, if we have to take some severe action, then we can, but we can actually, with industry, set up a slightly alternative arrangement to ensure that we can trial these new things. So in fact, the requirements don’t change what, but it’s simply a different way to get there.

So I think again, both sorts of parties have to come to the table on this and say, look, regulators will need to be agile. Industry wants to try new things and be more efficient as well, but we all, again, want the same thing. And being able to have that open conversation from the very start is gonna be important.

But I will caveat to say that all that takes a lot of additional resources. Can do on both sides as well. Yeah. So there is always a little bit of it’s a two-edged, the double-sided. It’s a double-edged sword.

[00:27:19] Cronan McNamara: Exactly. But as we were saying earlier, resources are not growing in this environment.

So it’ll be challenging to get the attention and. But as you say, make it as easy as possible for the regulators to go on that journey with you. In terms of new technologies, we’re just gonna wrap up in one minute, and thanks for the questions. We have one final question, Andrew, and it’s an interesting one.

We’re talking about these constructive conversations between regulators and food safety, and we think of things like. That can be conflicting. And I mentioned a little bit earlier, like sustainability versus food safety, exactly how do you have those constructive conversations with regulators on food safety and sustainability?

When perhaps the science and technology are still emerging.

Navigating Sustainability vs. Food Safety

[00:28:00] Andrew Wilson: From a regulatory point of view, again, regulators are always going to hold up food safety as the paramount thing. If it’s more sustainable, but raises the risk around food safety, it just doesn’t pass muster. A lot of people will always from a political point of view, because ultimately all regulators have, in some regards, to answer to governments of the day. The governments are looking to minimize the burden on the public health system first and foremost. And it will always be front of mind in that regard.

But I think to go back to the behavior thing again, being able to approach a regulator, being able to have that honest and open conversation, shows them that you’re willing to engage on these things early. And, hopefully, they should reciprocate that engagement as well.

So there’s the, yeah, to, to that, those sort of behaviors give you confidence as a regulator as well, that if there is any issues, you’re gonna hear about ’em early from those businesses.

[00:28:53] Cronan McNamara: Just one final question to get back to our main topic of the day. What advice could you give to suppliers aiming to stay ahead of regulatory and retailer expectations in this modern day?

Final Advice for Suppliers

[00:29:06] Andrew Wilson: Probably the biggest piece of advice is a bit of a mantra for me, is engagement’s key here. All right? Don’t be afraid to talk to your regulator about these things and many other cases. Certainly, from my experience anyway, when I was working in the regulatory space, it was already always very much appreciated.

When you wanna bring them up and talk to ’em about perhaps the rising risk you’ve seen or something like that, because as I mentioned earlier, with resources being ever tighter, we’re going to require that engagement relationship with businesses too. Structure the way we look at our overall compliance scheme.

We’re seeing all of these resource shortcomings happen right now in the US and in the UK and so forth. So it is gonna continue in that regard.

“As I said, my one key piece of advice is engaged with your regulator.”

[00:29:55] Cronan McNamara: Okay, I think that’s a super perspective, and thank you so much, Andrew, for joining us this evening.

Your time this morning in Europe on this series of how retailers, regulators can evaluate suppliers. I think it was a fascinating conversation. So again, thank you so much for your time. Thanks, everyone, for joining. Thanks for your questions, and we’ll see you at the next one. Thanks and goodbye.