SUPPLIER AUDITS

Supplier and Co Packer Hygiene Audits: How to Check the Sites That Make, Pack or Store Your Food

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 24 min read

A supplier or co packer hygiene audit is a second party audit: you, or an auditor acting for you, check the site that makes, packs or stores your food against your specification, your contract, R638 of 2018 and good manufacturing practice. A GFSI recognised certificate covers the site’s system, but not your product, your allergen claim or your label. Risk decides when you need your own audit. ASC runs independent supplier, co packer and hygiene audits across South Africa and trains your team to run their own.

Why do brand owners audit the sites that make their food?

You audit the sites that make, pack or store your food because the responsibility follows your name on the label. South African consumer law treats a company whose brand creates the expectation that it made the goods as a producer, and ISO 22000 and BRCGS both require you to control what you outsource.

Three pieces of South African law meet at the co packer’s door.

The first is the Consumer Protection Act 68 of 2008. Its definition of “producer” includes a person who, by applying a business name, trade mark or other visual representation to the goods, has created a reasonable expectation that it is the manufacturer. For a private label or contract manufactured product, that is usually you. Section 61 then makes producers, importers, distributors and retailers liable for harm caused by unsafe or defective goods, and where more than one party is liable, liability is joint and several. Our section 61 food label liability article explains more.

The second is the labelling regulations, R146 of 2010. Regulation 9(b) requires the label of a prepackaged foodstuff to carry the name and address of the manufacturer, importer or seller, and regulation 11 requires a batch number that makes the batch traceable.

The third is R638 of 2018, the hygiene regulations under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972. R638 places most of its operational duties on the person in charge of each food premises. Regulation 10(17) requires that food manufactured, kept or sold from the premises complies with the Act and its regulations, including labelling. Regulation 10(18) requires a traceability system maintained according to the best available method, a recall procedure, and reporting of any incident requiring recall activation to the local inspector and the National Directorate: Food Control. Your co packer carries those duties for its site; your audit tests whether it can meet them for your product.

The certification schemes point the same way. ISO 22000:2018 clause 7.1.6 requires the organisation to:

• establish and apply criteria for the evaluation, selection, monitoring of performance and re-evaluation of external providers;
• ensure adequate communication of requirements to the external providers;
• ensure that externally provided processes, products or services do not adversely affect its ability to consistently meet the requirements of the food safety management system;
• retain documented information of these activities and any actions taken as a result of evaluations and re-evaluations.

FSSC 22000 certified brand owners are audited on clause 7.1.6 too. BRCGS Food Safety Issue 9 is more specific.

When is a supplier’s certificate enough?

A valid GFSI recognised certificate is often enough for a lower risk supplier whose certified scope covers the material you buy. It is not enough on its own when the site makes your finished product to your specification, handles a high risk or ready to eat product, carries your allergen claim, or has a history of problems.

BRCGS Issue 9 clause 3.5.1.2 sets out the approval routes for raw material and packaging suppliers: a valid certificate to the applicable BRCGS or GFSI benchmarked standard with the purchased materials in scope; a supplier audit covering product safety, traceability, HACCP review, product security and food defence, authenticity and good manufacturing practice; or, for suppliers justified as low risk only, a completed questionnaire reviewed by a competent person.

Clause 3.5.4 goes further for outsourced processing: an intermediate step completed at another company or site, with the product then returning to the certificated site. The six requirements are:

1. 3.5.4.1 Declare itThe outsourced step is declared to the customer and, where required, approved.
2. 3.5.4.2 Approve and monitorOutsourced processors are approved and monitored for product safety, quality and traceability.
3. 3.5.4.3 Put it in the HACCP planRisks to product safety, authenticity and legality from the outsourced process form part of the site’s food safety plan.
4. 3.5.4.4 Write a service specificationRequirements for the outsourced process are agreed and documented, including any specific handling requirements.
5. 3.5.4.5 Contract and traceContracts define the processing requirements, and traceability is maintained.
6. 3.5.4.6 Inspect and testInspection and test procedures apply to products that were partly processed elsewhere, with frequency and methods based on risk assessment.

BRCGS guidance on Issue 9 draws one boundary: product stored at a contracted warehouse that does not come back to the site is a service under clause 3.5.3, not outsourced processing under 3.5.4. The warehouse still needs approval and monitoring.

Check the certificate before you rely on it

Foundation FSSC lets you verify an FSSC 22000 certificate on its Public Register by QR code or certified organisation code. For BRCGS sites, the public Directory lists certificated sites, and the BRCGS Verify service also shows expired, suspended and revoked sites. Neither shows the full audit report unless the site shares it with your account, so ask for it. Then check the scope and site address against what you buy.

Add your own audit for a new co packer or site, high risk or ready to eat food, your allergen claim, a process outside the certified scope, recent complaints or positives, or a customer that asks for it. Our supplier approval risk assessment guide shows how to rank suppliers and match evidence to risk.

How do you plan a second party audit?

A good second party audit starts weeks before the visit. Set the objective and criteria (your specification, the contract, R638, GMP and any scheme clauses), collect documents in advance, book the day your product is running, and send an auditor who understands both auditing and the process. ISO 19011 gives the method.

ISO 19011, the guidance for auditing management systems, was reissued as ISO 19011:2026 on 27 May 2026, and the Chartered Quality Institute notes that the revision expands guidance on remote auditing methods. The 2018 edition had already added a risk based approach to the principles of auditing. Manage supplier audits as a programme, not a string of visits.

1. Define the programmeList every site that makes, packs, stores or transports your food, with its risk tier, approval route and audit frequency.
2. Set objective, scope and criteriaName the site, the products and lines in scope, and the documents you audit against. “General hygiene” is not a criterion. “Our specification SP 014, R638 and the quality agreement” is.
3. Request documents aheadCertificate and last certification report, certificate of acceptability, HACCP plan for your product, allergen matrix, environmental monitoring results, pest control reports, cleaning verification and complaint logs.
4. Choose the dateAudit while your product runs. A quiet factory shows little about changeovers, rework and label control.
5. Pick a competent, independent auditorAuditing skill plus process knowledge. The buyer negotiating price should not grade the site.
6. Run the auditOpening meeting, the floor during production, records and a trace of one of your lots, then a closing meeting that agrees every finding.
7. Report and follow upGraded findings, agreed corrective action dates, evidence required for closure and the approval decision, all retained as ISO 22000 clause 7.1.6 (d) expects.

Should the audit be remote, on site or hybrid?

Remote audits work well for documents, records, trace exercises and interviews. They work poorly for hygiene condition, pests, condensation, drains, allergen segregation and real staff behaviour, because the site controls the camera. For a co packer making your product, keep the floor inspection on site and move the paperwork online where that saves time.

No video call shows you what is behind the pallet racking, so decide the method per supplier, by risk.

What should you check at a co packer beyond hygiene?

At a co packer, hygiene is only the starting point. You also need to see that your specification is followed, your allergens and labels are controlled, rework follows rules, your lots can be traced, the environment around your line is monitored, pests are controlled and cleaning is verified. These are the failures that lead to recalls under your brand.

Our hygiene audit guide and most common hygiene audit findings cover the hygiene side. Below are the checks a generic checklist tends to miss.

Your specification

Confirm the co packer works from the current, signed version of your specification: formulation, process parameters, critical limits, packaging, shelf life, storage conditions and release criteria. FSSC 22000 Version 7 clause 2.5.1 (d) requires organisations in food chain categories BIII, C, D, I, FII, G and K to have a review process for raw material and finished product specifications, and BRCGS clause 3.5.4.4 calls for a documented service specification where processing is outsourced. On the floor, compare your batch record with the specification; substituted “equivalent” raw materials are where drift starts.

Allergen and label control

• An allergen matrix that includes your product and every other product on the same line.
• Scheduling that runs allergen containing products after yours where possible, and validated cleaning where not.
• Signed line clearance and changeover checks, with old labels and packaging physically removed.
• Label and artwork version control: the version on the line matches the version you approved.
• Label verification at start up, changeover and each reel change, with a retained label on the record.
• A documented basis for any precautionary allergen statement on your pack.

See our allergen management guide for more.

Rework

Rework rules should cover which products may receive rework, allergen compatibility (like into like), maximum inclusion, storage, labelling and traceability into the finished lot. If rework crosses between your product and another customer’s, you need to know and agree.

Traceability of your lots

Pick one of your finished lots and trace it backward to raw material batches and packaging, and forward to dispatch, with a quantity check at each step. R638 regulation 10(16) requires these records to be kept for at least six months after the shelf life. Time the exercise and note where it stalls.

Pest control

R638 regulation 10(3) requires the person in charge to take effective measures to prevent or eliminate flies, other insects, rodents, birds and other pests on the food premises. Look beyond the service certificate: the device map, trend reports, activity near your line and stock, and whether the provider’s recommendations were closed. Start at external doors, dock levellers and drains. The pest control risk assessment guide shows how the programme should be built.

Cleaning verification

A cleaning schedule shows intent. Verification shows results. Ask for pre operational inspections for your line, chemical concentration checks, ATP or swab results and allergen cleaning validation. Then inspect the hard to clean points yourself: under conveyors, inside guards and around seals. Our cleaning and disinfection risk assessment guide covers programme design.

Subcontracting, testing and release

Confirm whether any step is sent elsewhere and declared to you. Check what is tested before release, at which laboratory, and whether product is held for results. FSSC 22000 Version 7 clause 2.5.1 (a) expects laboratory analysis used to verify or validate food safety parameters to be done by a competent laboratory.

What should you ask about environmental monitoring on your line?

If your product is exposed to the factory environment after its kill step, or is ready to eat, ask the co packer for its environmental monitoring results for the zones around your line, not a summary of the whole site. Look at what is swabbed, how often, what was found, the trend, and what happened after each positive.

FSSC 22000 Version 7 clause 2.5.7 requires a risk based environmental monitoring programme for food chain categories BIII, C, I and K, as the FSSC 22000 Version 7 scheme sets out. Our clause 2.5.7 guide explains what an auditor expects to see. The stakes are clear: the 2017 to 2018 listeriosis outbreak recorded 1 060 cases and 216 deaths where the outcome was reported, according to WHO.

What to look for in the co packer’s data:

• Sampling points mapped by zone, including zone 1 food contact surfaces where your product is exposed, and target organisms suited to the product, for example Listeria spp. or Listeria monocytogenes for ready to eat lines, and Salmonella and Enterobacteriaceae for dry, low moisture products.
• Swabbing during production as well as after cleaning, so the programme finds harbourage and not only cleaning failures.
• A neutralising broth matched to the sanitiser in use, and a competent laboratory.
• Alert and action levels, and records of each positive: vector sampling, root cause, and hold and release decisions.
• Some positives for indicator organisms. A programme that never finds anything may be sampling the wrong places or the wrong times.

For programme design, see our microbiological risk assessment and environmental monitoring guide, and for common audit findings, the environmental monitoring nonconformities article.

How do you audit cold stores, distributors and uncertified suppliers?

Cold stores, distribution warehouses and small local suppliers need auditing too, often more than certified manufacturers. R638 defines “handle” to include keeping, storing and transporting food, so a cold store is a food premises with the same duties as a factory. A graded hygiene audit against R638 gives you independent evidence where no GFSI certificate exists.

Cold stores and distributors

Under R638, food premises include any building, structure or vehicle used in connection with the handling of food, and regulation 3(1) prohibits handling food on premises without a valid certificate of acceptability. Regulation 13 requires any part of a vehicle carrying food to be clean enough to prevent chemical, physical or microbiological contamination. At a cold store or distributor, audit:

• The certificate of acceptability, and that it covers the activities performed.
• Temperature records for every chamber holding your product, alarm responses and probe calibration.
• Door discipline, condensation and ice build up over stock.
• Segregation of raw, ready to eat and allergen containing stock, and a quarantine area that is actually used.
• Pest control around docks, and vehicle cleaning and pre loading inspection records.
• Traceability of your pallets in and out, including split pallets and returns.

Small suppliers without GFSI certification

Many good local suppliers have no FSSC 22000 or BRCGS certificate. They still have duties under R638: a certificate of acceptability, and a person in charge who is suitably qualified or adequately trained in food safety and hygiene and who ensures that other staff are trained too (regulation 10(1)). An independent audit gives you graded evidence and the supplier a clear improvement list. ASC’s hygiene audits rate sites from one to five stars, with Platinum, Gold, Silver and Bronze certificates and no certificate at one star; Platinum and Gold certificates are typically valid for 12 months and Silver for six months. ASC lists certified sites, with rating and validity, on its hygiene audit client database.

For many small outlets or franchise suppliers, see our guide to a multi site hygiene audit programme.

How do you score the audit and decide on approval?

Score a supplier audit so the result drives a clear decision: approved, approved with conditions, or not approved. Weight sections by risk, define critical findings that override the total score, and link the outcome to the next audit date. A high average should never hide one failure that could put unsafe food in your pack.

A workable scoring model has four parts:

1. Weighted sectionsWeight allergen and label control, traceability, environmental monitoring, pest control and cleaning above housekeeping and administration.
2. Graded findingsCritical (an immediate risk to product safety or legality, or falsified records), major (a system failure that could lead to unsafe product) and minor (an isolated lapse with low risk).
3. Override rulesAny critical finding means not approved, or suspension of an existing approval, regardless of the percentage. Typical critical findings: active pest infestation in product areas, no allergen control for an allergen in your product, a zone 1 pathogen positive with no action, a failed trace of your lot, falsified records, no certificate of acceptability.
4. Decision bandsApproved; approved with conditions and a follow up date; not approved. Each band sets the next audit interval and any extra verification, such as increased incoming testing.

The supplier’s risk tier sets the baseline frequency; audit results and performance move it up or down, as in our supplier approval risk assessment article. Record the decision, the evidence and the approver, as ISO 22000 clause 7.1.6 (d) expects.

What if the supplier with findings is hard to replace?

When the supplier is hard to replace, do not quietly lower the standard. Keep the finding graded as it is, agree a time bound corrective action plan with root cause, add compensating controls such as extra testing or positive release, escalate to senior management on both sides, and start developing an alternative in parallel.

With a single source co packer or ingredient, the pressure to “approve and fix later” is real. A sound way through:

• Keep the grading honest. A critical finding stays critical. Record a conditional approval with a documented risk acceptance signed by the accountable person in your business.
• Demand root cause, not only correction. Cleaning the drain is correction. Finding out why it keeps blocking is root cause.
• Add compensating controls. Increased incoming testing (BRCGS clause 3.5.4.6 already expects it on a risk basis), positive release, extra environmental samples around your line, or your QA present during your runs.
• Verify closure properly. Dated evidence for minor findings; a follow up visit for majors and criticals.
• Escalate early. Put the plan, with dates, before senior management on both sides.
• Develop an alternative. Even a partially approved second source changes the conversation.

Which contract clauses make the audit possible?

An audit is only possible if the contract allows it. Your supply or quality agreement should give you a right of access, access to records, prompt notification of pathogen positives, recalls and regulatory inspections, and control over changes and subcontracting. Without these clauses, the co packer can simply decline.

Clauses to look for (have your attorney draft the wording; this is practical guidance, not legal advice):

• Right of access: you, or an auditor you appoint, may audit the site at agreed notice, and without notice where there is a food safety concern.
• Access to records: batch records, environmental monitoring results for your area, pest control reports, cleaning verification, complaints and certification audit reports.
• Notification of positives: pathogen positives on product or food contact surfaces in your area, within an agreed number of hours, with the actions taken.
• Notification of recalls and incidents: any recall or withdrawal at the site, and any incident reportable under R638 regulation 10(18), even where another customer’s product on a shared line is involved.
• Regulatory contact: visits by environmental health practitioners or other inspectors, notices issued, and changes to the certificate of acceptability.
• Certification status: suspension, withdrawal, scope change or a change of certification body.
• Change control: no change to formulation, raw material source, process, site or line without your written approval.
• No subcontracting of any step of your product without declaration and written consent.
• Traceability and records: a trace response within an agreed time, and records kept as R638 regulation 10(16) requires.
• Retained samples and cooperation in any investigation or recall.

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for site specific advice.