Food Safety Programmes: Culture, Food Defence, Allergens, Recall

What are cross-cutting food safety programmes?

They are the systems that protect the product beyond the HACCP plan, and that every GFSI-recognised standard audits: food safety culture, food defence, food fraud, allergens, traceability and recall, environmental monitoring, pest control and labelling. The HACCP plan deals with the hazards of a process. These programmes deal with what runs through it: people, materials, suppliers, premises and customers.

They are not optional. In the official BRCGS Food Safety Issue 9 self-assessment checklist, senior management commitment (1.1), which carries the culture plan, traceability (3.9), housekeeping and hygiene (4.11), allergen management (5.3) and labelling and pack control (6.2) are fundamental requirements. In FSSC 22000 Version 7, most of these programmes sit among the Part 2 additional requirements, audited together with ISO 22000:2018 and the ISO 22002-100:2025 prerequisite programmes.

The table below places each programme in the official texts. It does not replace reading the standards, but it saves you documenting the same thing twice.

IFS Food Version 8 covers these topics too; its official page lists a food fraud guideline among the risk management tools that IFS makes available. The IFS column numbers come from the official Version 8 text; only traceability and recall management are KO requirements among these programmes.

For a site outside Morocco, such as a spice blender in Egypt or a cashew processor in Côte d’Ivoire, the last column becomes the national food law of the country of production and of each country of sale. The first two columns stay the same.

What does the auditor check, programme by programme?

The auditor does not just read your procedures. They look for proof that the programme runs, on the line, and has done so for several months, and they look for it by questioning teams as much as by reading records. Here is what is expected, and the evidence that answers it.

A useful habit: for each row, name an owner and keep a piece of evidence “from today”. If the evidence exists only in the quality department’s binder, the auditor will notice when they question a night-shift team leader.

The table also works the other way round. A buyer from a European retailer or a Gulf importer auditing a supplier can use it as a second-party audit grid.

Food safety culture: how do you measure and prove it in a GFSI audit?

By treating it as a programme, with a plan, measurements and a review. BRCGS Food Safety Issue 9 (1.1.2) asks senior management to define and maintain a plan for the development and continuous improvement of food safety and quality culture. The plan covers at least communication on product safety, training, employee feedback, expected behaviours and the measurement of performance of activities related to product safety, authenticity, legality and quality. It includes an action plan with timescales and a review of the effectiveness of completed actions, and it is reviewed at least once a year.

FSSC 22000 Version 7 (2.5.8) puts it in other words: culture objectives set by top management, sufficient resources, and a documented plan with targets and timelines, built into management review and continual improvement. The minimum elements are communication, training, employee feedback and engagement, and performance measurement. The scheme adds that demonstrable commitment from all personnel must be available.

What does the GFSI say?

In March 2026, the GFSI published version 2.0 of its position paper “A Culture of Food Safety”. It describes five dimensions on two levels. The foundations are the company’s values, vision and mission, and its people (engagement, empowerment, accountability). The visible practices are hazard and risk awareness, consistency in applying the system, and adaptability and continuous improvement.

The GFSI defines the “what” and leaves the “how” to scheme owners, experts and companies. It provides neither a maturity model nor a diagnostic tool. It does recommend that the assessment covers every dimension, with techniques suited to locating the site’s maturity.

How do you measure it in practice?

No standard imposes a specific questionnaire. A credible measurement combines several sources:

• an anonymous staff survey, in the teams’ own working language;
• short interviews with operators, team leaders and seasonal workers;
• shop-floor observation: handwashing, workwear, what people do when product falls on the floor;
• existing indicators: hygiene deviations, reported near misses, complaints, cleaning results, training completed.

In an Agadir cannery that doubles its workforce during the sardine season, a survey run in the low season says nothing about culture at full production. The plan must include a measurement at the peak. Otherwise, an auditor arriving unannounced will find a different site from the one the plan describes. The same holds for any packhouse that hires heavily at harvest, in North Africa as in West Africa.

What should you show the auditor?

The signed plan, the results of the latest measurement, the actions decided and their status, and the management review minutes that discuss them. Above all, a management team able to explain, without notes, what has changed since last year. A culture plan known only to the quality manager does not survive an interview with the plant director.

Food defence (TACCP) and food fraud (VACCP): how do you assess vulnerabilities?

With two separate assessments, carried out by competent people, documented and reviewed at least once a year. TACCP and VACCP are widely used methods to structure these assessments. The standards do not impose the acronyms: they require a written assessment and a plan that follows from it.

Assessing fraud, material by material

BRCGS (5.4.3) sets five criteria for each raw material or group of materials: the history of substitution or adulteration, the economic factors that make fraud attractive, how easily materials can be accessed in the supply chain, the ability of routine testing to detect an adulterant, and the nature of the material. The site must also keep informed of historical and emerging threats (5.4.2), for example through trade associations or public sources. Where a material is judged at risk, the plan sets out assurance or testing measures (5.4.4).

For an olive oil exporter in the Meknès region, the right question is not “is olive oil at risk?” but “which supplier, which lot, which test, how often?”. For a Casablanca biscuit maker, cocoa and milk powders, nuts and flavourings often need the most attention. A buyer reviewing a supplier’s assessment should expect the same level of detail: named materials, named suppliers, a testing plan.

Claims matter too. When a label claims an origin, a variety or a raw material status, BRCGS (5.4.5) requires the status of each lot to be verified and mass balance checks to be carried out, at least every six months where a certification scheme sets no requirement of its own.

Assessing threats, area by area

The food defence plan (BRCGS 4.2.2 to 4.2.4) starts from internal and external threats, identifies the materials and products most exposed and defines sensitive areas, including external storage and the intake points for materials and packaging. Where prevention is not enough, tampering must be detectable. Staff are trained, controls are monitored, and the plan complies, where relevant, with the law of the country of sale. For the United States, BRCGS offers an additional module dedicated to FSMA requirements.

FSSC 22000 adds a rule for traders that do not handle the product (subcategory FII): they must make sure their suppliers have their own food defence plan and food fraud mitigation plan.

Allergens: what is required, and where are the labelling traps?

Allergen management is a fundamental requirement of BRCGS Food Safety Issue 9 and a detailed additional requirement of FSSC 22000 Version 7 (2.5.6). Both texts ask for the same framework:

1. List the allergens present on site: raw materials, processing aids, intermediate and finished products.
2. Assess cross-contact routes at each step, taking into account the physical state of the material (powder, liquid, particulates).
3. Control: physical or time segregation, production scheduling, dedicated equipment, control of dust, waste and spills, rules for food brought on site.
4. Validate and verify cleaning. FSSC requires verification testing at a risk-based frequency when products with different allergen profiles share an area: surfaces, air or product.
5. Train all staff in allergen awareness, and each job in the measures that concern it.
6. Review the plan at least once a year, and after any significant change, recall or withdrawal linked to an allergen.

The classic trap is precautionary labelling. FSSC 22000 (2.5.6 e) allows it only when the risk analysis shows a cross-contact risk despite control measures that are actually applied, and states that it replaces neither the measures nor the testing. BRCGS (5.3.6) requires a justified, risk-based assessment, and the use of national legislation or guidance to word the warning.

In Morocco, Decree no. 2-12-389 requires prepacked products to declare any ingredient or processing aid listed in its Annex I that may cause an allergy or intolerance (article 11). The annex has fourteen groups: cereals containing gluten, crustaceans, eggs, fish, peanuts, soybeans, milk, nuts, celery, mustard, sesame seeds, sulphites above 10 mg/kg or 10 mg/litre expressed as total SO2, lupin and molluscs, with exceptions set out in the text. For exports, the list of the country of sale applies: BRCGS and FSSC both require labelling that complies with the law of the country of destination.

Traceability and recall: how do you pass the test?

By preparing it as a real exercise, timed, on a lot chosen at random. BRCGS Food Safety Issue 9 (3.9.3) requires traceability to be tested across all product groups, from raw material (primary packaging included) to finished product and back, at least once a year. For food materials and finished products, including printed packaging and labels carrying safety or legal information, the test includes a quantity check or mass balance. BRCGS states that traceability should be achievable within 4 hours.

The incident, withdrawal and recall procedure is also tested at least once a year, with the timing of key activities recorded (3.11.3). In the event of a significant incident, a recall or a regulatory nonconformity, the certification body is informed within 3 working days, then receives within 21 calendar days the corrective actions, root cause analysis and preventive action plan (3.11.4). FSSC 22000 Version 7 (2.5.17) sets the same 3-working-day deadline for public recalls, withdrawals and measures imposed by the authorities. During an FSSC audit, time spent on traceability exercises counts towards the share of the audit reserved for the shop floor.

Moroccan law points the same way. Law no. 28-07 on the safety of food products requires traceability at every stage of the chain: each operator must be able to identify its suppliers and the establishments it has delivered to (article 12). An operator with reason to believe a product is unsafe informs the competent authorities without delay (article 10). The procedures of its own-check programme are recorded and kept for at least five years (article 9).

Traceability test checklist

• Choose a finished lot at random, preferably a multi-ingredient product in printed packaging.
  
• Trace back to every lot of raw materials, processing aids and primary packaging.
  
• Trace forward to every customer delivered, with quantities and dates.
  
• Draw up the mass balance: quantities received, used, in stock, lost and shipped.
  
• List the documents consulted and show the links between them.
  
• Measure the total time and compare it with the 4 hours set by BRCGS.
  
• Include rework and downgraded products.
  
• Record gaps and actions, then repeat the test on another product group.
  

The test rarely fails on principle. It fails on a detail: a pallet of lids with no lot number, a part-used drum of oil, rework that was not traced. In a cannery, covering oil and cans are often the weak links; at a citrus packer, it is harvest lots merged at intake.

Listeria environmental monitoring and pest control: how do you build the plan?

Environmental monitoring

BRCGS Food Safety Issue 9 (4.11.8) requires a risk-based environmental monitoring programme for relevant pathogens or spoilage organisms, covering at least all production areas where product is open or ready to eat. FSSC 22000 Version 7 (2.5.7) makes it mandatory for categories BIII, C, I and K, with regular trend analysis. For a chilled ready-to-eat product, Listeria is often the target organism; the choice must come out of the risk analysis, not out of habit.

The programme sets out at least (BRCGS 4.11.8.1) the sampling procedures, sampling points, frequency, target organisms (pathogens, spoilage or indicators), methods (settle plates, rapid tests, swabs) and how results are recorded. It sets action limits, and the planned response to an upward trend, even below the limit (4.11.8.2).

Zoning is the most common way to distribute sampling points. The standards do not impose it in this form, but it gives the sampling plan a sound structure:

The programme is reviewed at least once a year, and also after a process change, a positive result on product, or a positive result found by the authorities that the site’s programme had missed. BRCGS cites one trigger that surprises many sites: consistently negative results. A site that never finds anything must check that it samples in the right places, in the right way and for the right organisms. FSSC sets the same trigger: no positive result over a long period.

Pest control

BRCGS (4.14) requires a preventive programme across the whole site, compliant with legislation, run by a competent contractor or by trained staff. Inspection frequency is set by a risk assessment. Records include an up-to-date bait station map, the products used, the activity observed and the treatments applied. Toxic rodenticide baits are not used in production or storage areas where product is open, except during an active infestation. An in-depth survey is carried out at least once a year by an expert, and results are analysed for trends.

In Morocco, IMANOR certifies pest management services against NM EN 16636. When choosing a contractor, it is one verifiable criterion among others; it is not a requirement of GFSI standards.

Labelling and export compliance: what should you check before shipping?

The label is where food safety meets the law of the country of sale. BRCGS (5.2.1) requires all products to be labelled in line with the law of the country of use, a process to verify ingredient and allergen labelling against the recipe and specifications, and approval of artwork. Labelling is reviewed at every change of recipe, material, supplier, raw material origin or legislation (5.2.2). In production, labelling and pack control (6.2) is a fundamental requirement: checks at start-up, during production, at packaging lot changes and at the end of a run, on the date code, lot, origin and allergen information.

FSSC 22000 Version 7 (2.5.2) adds two points that matter to exporters. Any claim (allergen, nutritional, production method, raw material status) requires validation evidence and verification through traceability and mass balance. A site that prints its own labels must control artwork, changes, each print run, printing errors and unused printed materials.

On the Moroccan side, Decree no. 2-12-389 sets the mandatory particulars for prepacked products (article 11) and requires Arabic, possibly alongside other languages (article 8). For imported products or products intended for export that cannot meet certain provisions for technical or commercial reasons, labelling compliance arrangements may be granted to their holder, on request, under the forms and terms set by order of the minister in charge of agriculture (article 30). The version of the decree published by ONSSA does not cite that order: before printing an export label that departs from the decree, ask the ONSSA office of your province whether an arrangement is possible and in what form.

For each destination market, keep an up-to-date fact sheet: reference text, language, allergen list, mandatory particulars, permitted claims. Production-method claims such as halal or kosher also require a valid certification: see our Halal and Kosher page.

Each fact sheet is built from the official texts of the destination country and confirmed in writing with the importer.

Are your programmes ready for the audit?

• The culture plan is signed by top management, measured and reviewed within the last twelve months.
  
• The threat assessment covers internal and external threats and defines sensitive areas.
  
• Every food raw material has a vulnerability assessment, reviewed since the last supplier change.
  
• The allergen matrix is up to date, cleaning is validated and its verification is recorded.
  
• Precautionary statements rest on a written risk assessment.
  
• A traceability test with mass balance was done within the year, in under 4 hours.
  
• A timed recall exercise took place within the year, out-of-hours contacts included.
  
• The environmental monitoring programme has limits, trend charts and an annual review.
  
• The pest control station map is up to date and the annual expert survey is done.
  
• Every export label has been reviewed against the law of the country of sale.
  
• Every programme has a named owner and a trained deputy.
  

If more than three boxes are still empty less than six months before the audit, start with a gap analysis of the programmes rather than with writing.

How does ACG set up these programmes?

By starting from your existing system and your customers, not from a template. The gap analysis compares your practices with the standards you target. We then build, with your teams, a cross-reference table that serves BRCGS, IFS and FSSC 22000 at once. The programmes rest on your HACCP plan and, if you are certified or planning to be, on your ISO 22000 or FSSC 22000 system.

For the standards themselves, see our BRCGS certification and IFS Food certification pages. To check your programmes before the auditor does, a mock audit or an outsourced internal audit falls under our audits and inspections service, which also covers supplier audits for buyers. To train your teams in culture, allergens, traceability or food defence, see our food safety training domain. For Moroccan companies, funding for this training may fall under the special training contracts, according to OFPPT rules: see CSF and OFPPT funding, with a simulation and no promised amount.

ACG counts 502 projects, 32 consultants and experts, more than 120,000 people trained and a 100% success rate on the certifications it supports. The full picture of our offer is on the food safety consulting page. For a first conversation, describe your project.