KO requirements

IFS Broker Audit KO Requirements: The Eight Knock Outs and the Majors Trading Companies Pick Up

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 14 min read

IFS Broker audit KO requirements are the eight requirements that a trading company must meet in full to be certified: 1.2.2 senior management responsibility, 2.3.1 the risk management system, 4.2.2 compliance with the customer specification, 4.6.1 traceability, 5.1.1 internal audits, 5.2.2 customer special analyses, 5.5.2 withdrawal and recall, and 5.7.2 corrective actions. A D score on any one of them subtracts 50 percent of the possible total and stops certification at that audit. This guide covers what the auditor tests under each KO, the Majors that brokers pick up beside them, and how ASC’s IFS Broker Version 3.2 toolkit closes them.

What happens to the score when a KO is missed?

Part 1 of the Standard scores a regular requirement A (20 points), B (15), C (5) or D (minus 20). A KO is harsher. B on a KO means a small part is not implemented with no effect on safety, legality or customer requirements, and it earns nothing. There is no C. If the requirement is not implemented, it is a D, which is a KO non-conformity.

So a broker with a strong system everywhere else can still fail on one KO. That is why I start every readiness review with the eight KOs.

Which eight requirements are KOs, and what does the auditor ask for?

How are KO 1 and KO 2 tested at a broker?

KO 1, senior management responsibility (1.2.2)

The auditor is looking for proof that the directors own the policy and pay for it. A signed policy on the wall is not enough. Expect to be asked which objectives were missed last year and what management did about it, what resources were approved for product safety, and whether they were delivered. The usual gap at a broker is a Quality and Technical Manager with a long job description and no time or budget allocated to it. IFSB035 Resource and Investment Plan and Approval Record puts those decisions in writing, with dates and owners, so the auditor can follow them into the management review minutes.

KO 2, the risk management system (2.3.1)

Brokers fail this KO in one of two ways. Either there is no hazard analysis at all, or there is a factory HACCP plan copied from a supplier that describes washing, packing and metal detection, steps the broker never performs. The auditor wants your broker steps, from contract and specification through supplier approval, release and logistics, each with its hazards, the control that sits at the supplier, the control you apply, a limit and a record. Then the flow diagram verified against reality, and a dated annual review. Our guide to the IFS Broker risk assessment shows how to build it.

How are the specification and traceability KOs tested?

KO 3, compliance with the customer specification (4.2.2)

Part 1 suggests the auditor samples a customer branded product, an own brand product, a product traded in small quantities and one traded in large quantities. For each, the auditor takes the customer specification as the reference and follows the evidence: the supplier’s approval and certificate, the consignment check, the test results, the label check and the delivery. A KO 3 problem often starts with the specification itself. If the file holds last season’s version and the customer has since changed a residue limit or a pack size, nothing downstream can prove compliance. Keep every specification on IFSB098 Specification Register and Review Schedule with its version and date, and check it against the customer before each season.

KO 4, traceability (4.6.1)

The auditor picks a product and asks you to trace it during the audit, upstream to the supplier and downstream to the customer, with quantities. Lot codes alone do not pass. You need to show how many cartons or kilograms came from which production unit or lot, how many were shipped in which container, and how many reached which customer. The Doctrine adds that all safety and quality information must be assignable to the product, bulk product and unlabelled consumer units included. IFSB131 Traceability Test and Mass Balance Record forces the quantity reconciliation at every step.

What catches brokers out on KOs 5 to 8?

KO 5, internal audits (5.1.1)

The programme must cover every requirement of the Standard, at a frequency set by risk, with the activities critical to product safety audited at least once a year (5.1.2). The trap is an internal audit that sampled the system instead of covering it. If the auditor finds a requirement that was never on your programme, you are close to a D. IFSB151 Internal Audit Checklist, IFS Broker Version 3.2 lists every requirement, so the programme can be ticked off line by line. Independence (5.1.3) matters too: nobody audits the area they run.

KO 6, special analyses demanded by the customer (5.2.2)

This is the only KO that can be scored N/A, and only when no customer demands special analyses. Many retail customers do, for example a residue screen with a lower limit than the law or a specific mycotoxin test on nuts. Each one must sit in a written testing plan, be carried out as specified, and have its results on file at your office. IFSB157 Customer Special Analysis Testing Plan takes each demand from IFSB091 Customer Requirements Register, so nothing agreed in a contract is missed.

KO 7, withdrawal and recall (5.5.2)

The procedure must cover all products, get customers informed immediately and make responsibilities clear. The auditor will read the procedure, check the contact list is current and ask for the last test. A withdrawal test done as a round table discussion, with no clock and no real calls, will not show the procedure works in practice, which requirement 5.5.4 asks for. Run it against a clock, phone the real supplier and customer contact, and record the times. Include the certification body notification step in the test as well, because a recall for a safety reason where you are legally responsible must reach the certification body within three working days.

KO 8, corrective actions (5.7.2)

Corrective actions must be clearly worded, documented, owned, timed and carried out quickly, with records that are secure and easy to retrieve. The subtle failure here is two documents that set different timescales for the same finding, for example an internal audit procedure that says 30 days and a corrective action procedure that says 60. KO 8 asks for clearly defined timescales, and two contradicting rules are not clear. In TK18 one grading table applies everywhere. Its illustrative defaults are a correction within 24 hours, root cause within five working days and the corrective action within 30 days for a critical finding, and five working days, ten working days and 60 days for a major grade finding, each confirmed by the company before use.

Which Majors do trading companies pick up?

A Major can be given on any requirement that is not a KO. Part 1 describes it as a substantial failure to meet the Standard, including product safety and the legal requirements of the producing or destination countries, or a process out of control that might affect product safety. Most broker findings are B or C deviations. The same gaps become Majors when they reach that level.

• 4.4.4: a product supplier with no recognised certificate and no active, evidenced customer acceptance. Generic terms and conditions do not count under the Doctrine.
• 4.4.4 again: a certificate that has expired, or whose scope does not cover the product or the site that supplied it.
• 4.4.7: consignments released before the checks or results the schedule requires, for example fruit shipped while a residue result is outstanding.
• 4.3.5 and 4.5.4: a customer branded label that is not legal in the destination country, such as an allergen not emphasised or sulphites not declared.
• 4.7.2: no food fraud vulnerability assessment of purchased products and packaging.
• 4.8.1 and 6.2: a cold store or haulier with no recognised certificate and a contract that says nothing about product safety or product defence.
• Not a Part 2 requirement, but checked at every audit under Part 1 section 10: the IFS Broker logo printed on cartons or on a customer branded pack.

Most broker Majors are not hidden. They sit on the supplier register, in plain sight, because nobody checked a certificate scope against what the supplier actually sends.

The food safety reasons behind several of these, residues, mycotoxins, allergens and sulphites, are explained in our guide to food safety hazards for fruit exporters and nut traders.

What happens after a Major or a KO?

1. At the closing meetingThe auditor presents the provisional findings. Senior management should be in the room, because a Major or KO is a decision they will have to resource.
2. Within two working daysFor a company already certified, a Major or a KO scored D leads the certification body to suspend the current certificate in the IFS Database, and customers following the company are notified.
3. Within four weeksReturn the action plan with corrections and corrective actions for every deviation and non-conformity, with owners and dates, and evidence of the corrections. Miss the deadline and a full new audit is required.
4. One Major and 75 percent or moreA follow-up audit within six months checks the Major on site. If it is resolved, a foundation level certificate can be issued.
5. A KO scored D, more than one Major, or under 75 percentNo certificate. A complete new audit is arranged, no earlier than six weeks after the failed audit.

Your audit timeline, from booking to certificate, is set out in our guide to IFS Broker certification in South Africa.

How do you run a KO pre-check before the audit?

Do this six to eight weeks before the audit date, so there is time to fix what you find and generate records that prove it.

1. Score the eight KOs honestlyUse IFSB009 Gap Analysis and Self Assessment Checklist, which applies the IFS scoring rules. Where a record is missing, score it as missing.
2. Pull three products the way the auditor willA customer branded product, a small volume line and a large volume line. Follow each from specification to delivery.
3. Run a live trace with quantitiesChoose a consignment in transit and reconcile packed, shipped and delivered quantities.
4. Read the supplier register against the certificatesCheck every certificate scope, site and expiry on the scheme owner’s database, and every customer acceptance for uncertified suppliers.
5. Test the recall against a clockReal calls, real contacts, timed, with the certification body step included.
6. Check one timescale rule for corrective actionsOpen every procedure that sets a deadline and confirm they agree.

If you would like an independent pair of eyes, ASC’s lead auditors can carry out the internal audit for you. Contact the ASC team. Directors who sign for KO 1 can take the IFS Broker Version 3.2 for Management Course, and the implementation course for trading companies walks through every KO with the toolkit open. For stand-alone fraud and defence assessments, see the Food Fraud Tool and Food Defence Tool.

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.