When “That's How We've Always Done It” Becomes a Compliance Problem

The employee has been doing the task for years. The process has always worked. Customers have not complained. Production has continued. The company has grown. When someone asks why the process is performed that way, the answer is simple: “That's how we've always done it.”

For many businesses, that phrase represents experience. It means: “We have learned what works.” “We know our operation.” “We have solved these problems before.” And that knowledge can be extremely valuable. But in a food safety and compliance environment, the same phrase can also reveal a potential weakness. Because compliance systems are not built only on what has been done historically. They are built on what can be demonstrated, controlled, reviewed, and maintained.

A process that has existed for years may be effective. Or it may be an outdated habit that nobody has challenged.

The difference is whether the organization understands why the process exists, how it controls risk, and whether it remains appropriate today.

Experience is valuable—but experience alone is not a system

Experienced employees often become the strongest source of operational knowledge. They know:

• Which steps matter most
• Where problems usually occur
• Which suppliers are reliable
• Which equipment creates challenges
• How employees actually perform tasks
• How issues are usually resolved

That knowledge helps businesses operate. The problem begins when the knowledge exists only with the people who remember it. A compliance system cannot depend entirely on “John knows,” “Maria handles that,” “We've always done it this way,” or “Everyone here understands the process.” Those statements may be true. But they do not necessarily create a repeatable system. A system requires that important processes can be explained, trained, documented, reviewed, and transferred.

The hidden risk behind “we always do it this way”

The phrase itself is not the problem. The problem is what happens when someone asks: “Why?”

• Why is the monitoring frequency set that way?
• Why is this supplier accepted?
• Why is this cleaning method used?
• Why is this record completed?
• Why is this person responsible?
• Why is this step performed?
• Why is this procedure written this way?

If the answer is “Because that is how we have always done it,” the organization may need to investigate further. A historical practice is not automatically a controlled practice.

A process can be effective and still need documentation

Imagine a facility has cleaned a piece of equipment the same way for ten years. Employees understand the process. The equipment performs well. The product quality is consistent. The sanitation results are acceptable. That is good. But ask:

• Is the process documented?
• Are employees trained on the current method?
• Are records maintained?
• Is the method reviewed when equipment changes?
• Is the process still appropriate for current products?
• Is the procedure updated when improvements are made?

The goal is not to replace practical experience. The goal is to preserve and manage it.

The “old employee” problem

Many food businesses have someone who has been there for years. They know everything. They know how suppliers are managed, which records matter, how problems are handled, which procedures need extra attention, and what changes have happened over time. That person is extremely valuable. But what happens if they leave? A new employee may receive the SOP. They may receive training. But they may still hear: “The SOP says that, but here's how we really do it.” That is a warning sign. The organization now has two systems: the documented system and the unofficial system. A mature compliance program works to bring those two together.

The production floor can expose outdated practices

Sometimes “that's how we've always done it” means the process has not changed. That can be good. Consistency matters. But sometimes it means the process has not been reviewed. Those are very different situations. A company may continue using:

• Old forms
• Old procedures
• Old approval methods
• Old supplier requirements
• Old training materials
• Old records systems

simply because nobody has asked whether they are still appropriate. A process should be maintained because it is effective—not only because it is familiar.

The regulatory environment changes

Food safety expectations continue to evolve. Businesses change. Products change. Manufacturing methods change. Supply chains change. Customer requirements change. A procedure created years ago may have been appropriate at that time. But the organization should periodically ask: does this still represent our current operation? A compliance system that never changes may not be a mature system. It may simply be an old system.

The supplier example

Consider a supplier relationship. A purchasing manager says: “We've used this supplier for fifteen years.” That history is valuable. But ask:

• Is the supplier information current?
• Are specifications current?
• Are required documents available?
• Has the supplier been evaluated?
• Have changes been communicated?
• Is the supplier still appropriate for the current product?

Longevity does not replace evaluation. A supplier can be trusted and still require ongoing management.

The employee training example

An experienced employee says: “I trained everyone myself.” That may have worked for years. But ask:

• Is there a defined training process?
• Are employees trained on current procedures?
• Are training records maintained?
• Are responsibilities clearly defined?
• Is competency evaluated where appropriate?

A person-to-person knowledge transfer can be useful. But a company needs a system that survives beyond individual trainers.

The recordkeeping example

An employee says: “We don't really use that form. We just know what to check.” This is a common situation. The employee may understand the process perfectly. But the business should ask:

• How is the activity documented?
• How is implementation demonstrated?
• How is the record reviewed?
• How are deviations identified?
• How is follow-up maintained?

A process that exists only in memory is difficult to verify.

The corrective action example

An experienced quality manager may know exactly what to do when a problem occurs. They immediately know who to contact, what product to hold, which records to review, what questions to ask, and what action to take. That expertise is valuable. But a growing organization needs more than one person's experience. The process should be understandable by other qualified personnel. Otherwise, every incident depends on finding the one person who knows what to do.

“We've never had a problem” is not the same as “the system is controlled”

This is another common assumption. A company may say: “We've been doing this for years and never had an issue.” That is positive information. But it does not answer every compliance question. A lack of problems does not automatically prove:

• The procedure is adequate
• The risk has been evaluated
• The records are complete
• The process is verified
• The system is prepared for change

A strong system does not wait for failure before evaluating itself.

The question is not “Who is wrong?”

When a traditional process is challenged, employees may feel defensive. They may think: “Someone is saying we have been doing everything wrong.” That is not always the case. Often the better question is: “What can we learn from how the process actually works?” The employee may reveal valuable operational knowledge. The document may reveal a gap. The organization may discover a better way. The goal is alignment.

The “why do we do this?” exercise

For important processes, ask:

• What do we do? Define the activity.
• Why do we do it? Understand the purpose.
• What risk does it control? Connect it to food safety or quality objectives.
• Who performs it? Define responsibility.
• How do we know it was done? Identify records.
• Who reviews it? Define oversight.
• What happens when it does not work? Define corrective action.
• What happens when the process changes? Define change management.

This transforms a habit into a controlled process.

A strong system captures the reason behind the process

One weakness of many SOPs is that they explain what to do but not always why it matters. Employees are more likely to follow processes when they understand their purpose. For example, instead of only stating “Inspect incoming materials,” a stronger system explains: “This inspection helps ensure incoming materials meet established acceptance criteria before use in production.” The employee understands the connection. The activity becomes meaningful.

The difference between tradition and control

Tradition says: “This is how we have always done it.” Control says something different.

“This is how we do it because we evaluated the process, defined the requirements, trained the people, documented the activity, and verified effectiveness.”

Both may look similar from the outside. But they are very different internally. One depends on history. The other depends on a managed system.

Growth exposes informal processes

A small company can operate successfully with informal knowledge. Everyone communicates. Everyone knows each other. Everyone understands responsibilities. Then growth happens. More employees. More products. More suppliers. More manufacturers. More customers. More documentation. More regulatory expectations. The informal system becomes harder to maintain. The phrase “Just ask someone who knows” becomes less reliable. Growth requires converting knowledge into systems.

The brand owner challenge

This is especially important for brand owners. A brand may not manufacture the product itself. The manufacturer may say: “We've always made it this way.” That may be true. But the brand owner still needs visibility into:

• Product specifications
• Manufacturing processes
• Supplier changes
• Documentation
• Food safety responsibilities
• Communication expectations

The relationship should not depend only on personal relationships. It should have defined processes.

The audit question behind the phrase

When an auditor, customer, or partner hears “That's how we've always done it,” the next question is often: “Can you show me?”

• Show me the procedure.
• Show me the record.
• Show me the training.
• Show me the review.
• Show me the corrective action.
• Show me the verification.
• Show me the change evaluation.

The organization does not need to eliminate experience. It needs to connect experience with evidence.

Turning tribal knowledge into a system

The solution is not to ignore experienced employees. It is to learn from them. Ask:

• What do you know that is not written down?
• What problems happen repeatedly?
• What steps are critical?
• What mistakes do new employees make?
• What decisions require judgment?
• What changes require special review?

Then determine what belongs in SOPs, work instructions, training materials, forms, records, supplier programs, corrective action procedures, and verification activities. This is how practical knowledge becomes organizational knowledge.

The “could someone else do this?” test

Choose an important process. Then ask: if the person responsible left tomorrow, could another qualified person perform this activity correctly? Could they:

• Find the procedure?
• Understand the responsibility?
• Complete the record?
• Handle a deviation?
• Identify who to contact?
• Continue the process?

If yes, the knowledge has become part of the system. If no, the organization may still depend on one person's memory.

The goal is not to change everything that works

This is important. A compliance improvement effort should not begin with “Everything we have done is wrong.” Many long-standing practices are effective. The goal is to ask:

• Does it still work?
• Can we prove it works?
• Is it documented?
• Is it understood?
• Is it transferable?
• Is it reviewed when needed?

A good system preserves what works and improves what needs improvement.

When FSVPServices.com helps transform habits into systems

FSVPServices.com supports food companies and brand owners in developing, implementing, reviewing, and maintaining compliance systems that move beyond informal practices. Support may include:

• Brand owner compliance SOP templates
• cGMP documentation and training programs
• cGMP implementation services
• Food safety plan development and implementation
• Food safety plan reanalysis and updates
• Hazard analysis development and evaluation
• Preventive controls program development
• Preventive control monitoring and management
• PCQI oversight and verification records maintenance
• PCQI-managed compliance per product SKU
• Supplier compliance management
• Corrective action and incident response programs
• Food handler qualification and training compliance
• Records compliance management
• Remote PCQI services for hazard analysis, monitoring, corrective actions, preventive controls, verification, and record review
• SOP development for manufacturing, sanitation, raw material control, warehousing, and distribution
• Training records and documentation compliance
• Verification, validation, and effectiveness review services
• USDA Organic compliance implementation and certification support services

Some companies need to build their system from the beginning. Others have strong employees but need to capture their knowledge. Some have procedures but need better implementation. Others need ongoing PCQI or FSQA support. The right approach depends on the company's products, processes, suppliers, manufacturers, employees, and current compliance structure. The objective is not to replace experience. It is to make experience part of a reliable system.

“That's how we've always done it” is a starting point—not the final answer

Experience matters. History matters. Practical knowledge matters. But a modern compliance system needs more than memory. It needs documented processes, trained employees, defined responsibilities, reliable records, effective review, corrective action, verification, and continuous improvement. So when someone says “That's how we've always done it,” the best next question is not “Why are you doing it that way?” Ask: “Can we explain why, demonstrate how, and prove that it still works?” Because that is the difference between a long-standing habit and a controlled compliance system.