What was the biscuit maker’s situation?
A certified biscuit maker, a demanding retailer and two third parties the retailer did not know about. This is a composite case study: it brings together situations met in subcontractor audits, without describing a real company.
The biscuit maker is based in the Casablanca-Settat region. It makes shortbread and plain biscuits under its own brand and is certified to IFS Food Version 8 for its production. It has won a private label range for a food retailer, whose quality team has announced an audit at the biscuit maker’s site three months later. The retailer’s specification requires every instance of outsourcing to be declared and approved in advance.
The range has three products. The shortbread is made on the biscuit maker’s own lines. The other two involve third parties:
- co-packer A, in the Fez-Meknes region, makes, packs and labels wafers under the retailer’s brand, because the biscuit maker has no wafer line; it is certified to FSSC 22000 Version 6;
- subcontractor B, a few kilometres from the biscuit maker, deposits a date paste filling on biscuit shells baked by the biscuit maker, then assembles the biscuits, which come back to the biscuit maker to be packed; it holds no GFSI-recognised certification.
How were the two audits scoped?
According to each third party’s regime, because the IFS Food Version 8 standard does not treat them in the same way. The wafers are fully outsourced products, not covered by the biscuit maker’s certificate. The filling is a partly outsourced process: the product belongs to the biscuit maker throughout the operation, and requirements 4.4.5 to 4.4.7 apply.
Third party | What it does | IFS Food Version 8 regime | Approval route | Format chosen |
|---|---|---|---|---|
Co-packer A | Makes the wafers under the retailer’s brand | Fully outsourced product, not covered; IFS Broker recommended | FSSC 22000 certificate, supplemented by an audit against the contract | Document review, then on-site audit on a production day for the retailer, after another customer’s run |
Subcontractor B | Deposits the filling and assembles | Partly outsourced process (4.4.4 to 4.4.7) | Documented supplier audit by an experienced and competent person (4.4.6) | Document review, then on-site audit during a filling campaign |
The biscuit maker appointed ACG for both audits. The auditor signed a declaration of no conflict of interest with each of the two sites. The document review covered A’s certificate, checked in the FSSC Public Register, the sanitary authorisations of both sites issued by ONSSA, Morocco’s national food safety office, their HACCP plans, their cleaning and changeover procedures, and A’s manufacturing agreement. For B, there were only purchase orders.
A’s certificate was valid and its scope covered wafer manufacturing. It did not name the retailer: FSSC 22000 does not allow brand names in the scope. It was a Version 6 certificate; v6 audits remain possible until 30 April 2027, and v7 upgrade audits take place from 1 May 2027 to 30 April 2028, according to the Foundation’s upgrade process. A’s upgrade date was requested in writing.
What did the wafer co-packer audit reveal?
A sound system, and two gaps that directly affected the retailer’s product.
The packaging film. In the packaging store, a pallet of film printed with the old version of the retailer’s artwork sat next to the current version, neither blocked nor identified. The old artwork did not highlight an allergen added to the recipe since. The contract required obsolete film to be destroyed. For a site that prints its own labels, FSSC 22000 Version 7 makes this a requirement of the scheme: management of obsolete artwork, approval of each print run, segregation of print variants (2.5.2 d).
Allergens. A new customer of A had a wafer with a peanut cream filling made on the same line. The allergen management plan had not been reviewed since that customer arrived. Yet FSSC 22000 requires a risk assessment covering all potential sources of allergen cross-contamination and, where products with different allergen profiles share a production area, verification testing at a risk-based frequency (2.5.6). No test was carried out after the cleaning that preceded the retailer’s runs.
The traceability exercise on a batch of the retailer’s product linked the finished product to the flours, the filling and the film within the time set by the site’s own procedure.
What did the filling subcontractor audit reveal?
Three gaps, two of which would have been enough to stop the product.
Traceability on return. Trays of filled biscuits came back to the biscuit maker identified by a date, with no batch number for the shells or the filling. A biscuit maker batch could not be linked to a run at B. Yet under IFS Food Version 8, a product from a partly outsourced process always belongs to the audited site: its traceability is the biscuit maker’s. A product whose traceability is lost on return can be neither withdrawn nor recalled with precision.
Another customer’s allergen. The same depositor was used for another customer’s peanut-based filling. Cleaning between the two runs was neither validated nor verified, and the order of runs was not fixed. The retailer’s date biscuit did not declare peanut.
No written agreement. No agreement described the in-process controls, the testing plans or the transport conditions, although IFS Food Version 8 requires one for a partly outsourced process (4.4.5).
On the biscuit maker’s side, the audit also showed two internal gaps: the filling step was not in its HACCP plan, and the retailer had never been told about the outsourcing, contrary to its specification and to requirement 4.4.4.
What decisions did the biscuit maker take?
Two different decisions, each with written conditions. The decision stayed with the biscuit maker; the auditor made recommendations.
Third party | Main findings | Decision | Conditions to lift |
|---|---|---|---|
Co-packer A | Obsolete film not blocked; allergen plan not reviewed after a peanut product arrived | Continued with conditions | Obsolete film destroyed; allergen plan reviewed; verification testing after cleaning before each retailer run; evidence sent remotely |
Subcontractor B | Traceability broken on return; cleaning not verified after peanut; no written agreement | Not approved at this stage, then approved after a follow-up audit | Agreement and service specification signed; batch numbers on every tray; retailer run after validated cleaning, with verification; on-site follow-up audit during a run |
The biscuit maker then brought its own system up to standard:
- the filling step was added to its HACCP plan, with a check of the trays on return: identification, integrity, temperature and testing based on risk;
- the retailer was informed in writing of the outsourced filling and of the wafers, and its agreement was obtained;
- at the next audit, the IFS Food certificate will carry the statement “Besides own production, the company has partly outsourced processes”;
- for the wafers, the biscuit maker began looking into IFS Broker certification of its trading activities, which the IFS Food certificate states in any case;
- reports, findings and action status for both third parties were tracked in the Inspirra client space.
At the retailer’s audit, the biscuit maker presented, for each third party, the contract, the specification, the full audit report, the closed action plan and the retailer’s written agreement.
What lessons for a brand that outsources?
A valid certificate showed neither the obsolete artwork, nor the new allergen, nor the traceability lost on return. Before your customer’s audit, check these points:
The general method is in our guide to the second-party food audit, and the step-by-step conduct in how to prepare and conduct a co-packer audit. The requirements specific to IFS Food are on our IFS Food certification hub, and the sector context on our food and beverage page.