Inspecting the Algorithm: What CFIA Cuts Mean for Food Brands After Joriki

I have wanted to write about the 2024 Joriki plant-based milk listeria outbreak and the 2025 CFIA audit of the perceived shortcomings of its multiplicative algorithm, the Establishment-based Risk Assessment ("ERA") Model, leading up to the crisis.

For context, the Globe and Mail reported that Joriki went approximately five years from when it received its licence under the Safe Food for Canadians Act ("SFCA") until the outbreak response without a licence inspection. By the time inspectors finally arrived in June 2024, three people were dead, twenty were sick, and Joriki, the co-manufacturer behind national leading brands of plant-based milks, was weeks away from shuttering its operations (it would go on to file for creditor protection with over $200 million in outstanding debts). But up until that point, the ERA model's algorithm did not direct CFIA to require them to go in.

I have followed CFIA's ERA model with great interest for some time. I had thought understanding the mechanics that underlie its multiplicative algorithm could help our firm better advise clients when allocating operating capital to optimize for regulatory scrutiny. Which it can. In the course of my research, I have met with some of the scientists who built it, read many peer reviewed journal articles, studied its multiplicative scoring approach, and spoken about it publicly in the food regulatory context. So let me start with the point that matters: the model is a serious attempt to direct limited inspection resources toward higher-risk establishments. I do not think that is the wrong idea.

My concern is what happens when the model is asked to do too much inside a system with weak inputs and finite resources.

The ERA model uses 16 risk factors to rank thousands of federally licensed food establishments. Higher risk facilities get more frequent inspections and lower risk facilities get less. Sensible stuff for an agency that is asked to regulate everything from invasive beetle quarantines to best-before dates.

The trouble starts when the data feeding the model is incomplete, stale, or never checked. CFIA's audit found that most of the model's risk factors depended on information supplied by the establishments themselves, which was voluntary. The same audit found no documented case, in the inspection sample it reviewed, of an inspector recording a verification of that information. Complaint data was also failing to feed into the model properly. A risk model can only rank the risk it is told about.

The Inspector General's review found inspection gaps in the manufactured food sector and significant non-compliance in facilities that were reviewed. CFIA responded with an inspection initiative that would start verifying information before granting licences to lower-risk establishments.

Then, in January, the federal government announced substantial staff reductions and a broader move toward digital tools, predictive systems, and a business-line model. That sequence raises a fair question. When a system fails because it lacks reliable inputs and inspection capacity, leaning harder on remote prioritization is not an obvious answer.

For brands, the takeaway might be that the regulatory paper framework is stronger than the inspection reality beneath it. That gap has practical consequences worth thinking through. Many lower-risk food businesses assume that robust federal licensing and inspections mean that serious problems are likely to be caught early. They may not.

We regularly assist in the preparation or review of preventive control documents. So, when I think about what this audit reveals, I immediately think about the SFCA-required preventive control plan, or PCP. A PCP is required for a licence, but it is not a licensing document you draft once and file away. In a recall, an enforcement matter, or a civil claim, it becomes a record of what a licensed business said it would do. If the sanitation program, environmental monitoring, or escalation steps exist on paper but not on the floor, the PCP does nothing to help and instead becomes evidence of failure. That risk is more acute now. With fewer inspectors and a model that may not flag your facility for years, the PCP could sit untested by the regulator for a long time — but it will not sit untested by a plaintiff's lawyer if something goes wrong.

This is also a co-manufacturing story. In this plant-based milk outbreak, Joriki was not the only participant left dealing with the consequences. Major brand owners and a national grocer were named as defendants in a class action settlement after the manufacturer entered insolvency proceedings. This is often how these matters unfold: if the operator cannot absorb the loss, the exposure moves outward to the solvent parties around it. If you use co-packers, this is a good moment to revisit audit rights, notice obligations, testing requirements, record access, indemnities, and insurance. General language about compliance with applicable law is usually too soft for this kind of risk.

The same goes for the information businesses give CFIA about their own operations. If establishment profiles help determine inspection priority, those profiles carry more weight than many businesses probably assume. An incomplete or overly optimistic description of products, processes, or controls can affect when the regulator attends. If a problem later emerges, that reporting history may sit in the file in a very awkward way. As of October 2025, CFIA has made the Additional Establishment Information questionnaire mandatory for new licences, renewals, and amendments — what was previously voluntary is now a licensing condition. That change should make the accuracy of these profiles a compliance priority, not an afterthought.

There is a policy question behind all of this. After the Maple Leaf Foods outbreak in 2008, Canada concentrated inspection resources in meat and used the ERA model to spread what remained across other sectors. That made sense as a response to the problem in front of government at the time. The manufactured food sector has changed since then. Product categories have changed. Supply chains have changed. The demands placed on our inspection model have changed as well.

I still think the ERA model is a strong and defensible answer to a real resource problem. CFIA's action plan shows the Agency is taking the audit findings seriously: mandatory data submission, enhanced complaint data integration, the addition of chemical hazards to the model's risk calculations, and stronger enforcement tools including administrative monetary penalties. These are real improvements. However, I do not think the model can carry more weight than the system around it allows. If the inputs are unreliable, complaint data does not move in cleanly, and there are fewer inspectors available to test what the model is being told, there is going to be dissonance between regulatory theory and the manufacturing plant floor.

For businesses, the working assumption should be simple. You may go a long time without seeing an inspector. This should be a reward for building a culture of food safety. So, keep your food safety program, your co-manufacturer controls, and your records front of mind. If CFIA attends, you will be ready. If it does not, your systems still need to hold.