We audit your suppliers, on your protocol, in your name

The protocol is built from documents you already own: the product specification, the supply agreement and its quality clauses, the approved artwork, the test schedule, the complaint file and any recent withdrawal. Legal duty goes in next, including the certificate of acceptability required under the general hygiene requirements published as R638 of 22 June 2018 in Government Gazette 41730 under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972, and the labelling requirements of R146 of 1 March 2010 where the supplier applies the label. Where you export, the destination market’s rules enter as your requirements.

Severity is then defined before the first audit, by consequence rather than by auditor mood, with the evidence that closes each grade named at the same time. Weighting follows your risk, so if allergen segregation would end your brand it carries the weight, whatever share of the day it occupies. Auditors are calibrated against each other, because otherwise a ranking measures who audited rather than who performed.

Tiering comes before scheduling, on the inputs that predict harm: the nature of the product, with ready to eat and allergen bearing material treated differently from shelf stable thermally processed goods; your exposure by volume; whether a certificate exists and whether its scope covers what you buy; complaint history; and how new the relationship is.

Frequency then follows tier rather than habit. The baseline is an annual audit with the report within two weeks. Higher tiers earn more frequent attendance, an unannounced element or a targeted return audit, and lower tiers can be held with desk verification between visits. Movement rules are written in advance, because a re tiering argued after an incident convinces nobody.

An announced audit shows the site as it presents when prepared, which is the right way to test system design, documentation and validation. A semi announced audit names a window rather than a date, and an unannounced audit gives no notice beyond arrival at the gate.

Unannounced work is strong evidence of routine state: the hygiene of the line on an ordinary day, the staffing actually deployed, whether records are written as work happens or reconstructed afterwards. It is weak evidence of system design, because the people who own the system may not be there, and it can fail entirely at a seasonal packhouse not running product. Unannounced audits verify behaviour and announced audits verify design, so a serious programme uses both, with the right of access written into the supply agreement first.

A customer or second party audit runs one day on site: a meeting fixing scope and protocol, a traceability and mass balance exercise on a batch the auditor chooses, a walk of the line during production, verification of every control the protocol named, and a sampling of records across a period. Findings are presented to management at the closing meeting.

Every finding carries the batch or record reference, the date, the quantity examined and, where site rules permit, a photograph, so a different competent auditor working from the report alone could return and find the same thing. Traceability remains the most revealing hour of the day, because a supplier that can move from finished pack back to raw material lot, packaging lot and dispatch record, and reconcile the quantities, has a system that works.

Removing contaminated stock is a correction. Establishing why the control failed and changing what allowed it is corrective action. A response offering only the first leaves the failure in place, and it is sent back.

Closure follows the evidence the finding named when it was raised: a document control record where it was documentary, dated training records where it was about people, a revised specification where it was about specification drift, and verification records over a period where a control must hold over time. Where the supplier proposes another route, the substitution is recorded with the conditions under which the original burden revives. Status language stays exact: open, open with a route agreed, conditionally closed pending named evidence, or closed. A return visit is warranted where the finding was critical, where the failure was in execution, or where it has recurred.

ASC audits to ISO 19011, the international guidelines for auditing management systems, which sets the principles the audit runs on: integrity, fair presentation, due professional care, independence and evidence. ASC audits are led by lead auditors registered with SAATCA, Exemplar Global and IRCA. Competence changes what a finding is worth, because a competent lead auditor grades it at the severity its consequence justifies, holds that line when a supplier pushes back, and writes it so it survives that supplier’s certification body reading it.

Conflict of interest is managed by disclosure and separation rather than by assurance. No individual audits a system that individual designed or implemented, any consulting relationship with the supplier is disclosed to you in writing before scheduling, and where it is material you decide whether ASC audits that site at all. Ask every provider whether it consults to the supplier it is about to audit for you, and ask for the answer in writing.