What should you decide before announcing the audit to the co-packer?
The decision the audit must make possible, and the basis on which it will be conducted. An audit launched “to have a look” brings back generalities; a scoped audit brings back an answer. The requirements BRCGS, IFS and FSSC 22000 place on the brand owner are summarised in our guide to the second-party food audit; this page covers how to put them into practice.
Item to set | Question to settle | Where to write it |
|---|---|---|
Objective | First approval, renewal, new product, complaint, preparation for your customer’s audit? | Scoping note |
Decision expected | Who decides, and between which options: continue, continue with conditions, suspend? | Scoping note |
Scope | Which products, lines, addresses and steps? | Audit plan |
Criteria | Contract, service specification, recipe, artwork, your customer’s requirements, the co-packer’s standard | Audit plan |
Audit right | Does the contract provide for the announced audit, the for-cause audit, access for your customer’s auditor? | Manufacturing agreement |
Confidentiality | What will the auditor see of the co-packer’s other customers, and who will receive the report? | Engagement letter |
Impartiality | Does the auditor have any link with the co-packer? | Signed declaration |
Gather your own documents too before writing to the co-packer: the current specification, the approved artwork, your HACCP plan, which must include the outsourced step (BRCGS 3.5.4.3), complaints, the results of your checks at receipt or on the product’s return, and the site’s latest audit report.
Which questionnaire should you send to the co-packer?
A short questionnaire, focused on what the co-packer does for you, returned with supporting documents before the document review. It prepares the audit; it is not an approval. For outsourced processing, the BRCGS F904A checklist (3.5.4.2) and the IFS Food Version 8 standard (4.4.6) accept only two routes: a GFSI-recognised certificate that covers the activity, or an audit.
The questionnaire covers at least:
Which documents should you review remotely before the visit?
Those that let you choose what to test on site. The document review does not judge the site: it builds the list of points to check in production.
Start with the certificate. Check its validity, version and scope in the BRCGS Directory, the IFS Database or the FSSC Public Register. The scope will not name your brand; it must cover the process and the address. Then ask for the latest certification audit report and the actions that followed it.
Finally, for your product, read the co-packer’s HACCP plan, its allergen management plan, its artwork management and print control procedure, its changeover procedure, its release records and its latest test results. Every inconsistency between these documents and your specification becomes a point to test.
How do you build the on-site audit plan?
By following your product’s flow, on a day when it is in production. The audit plan is sent to the co-packer in advance; it sets the order of the day, not a standard duration, which depends on the site and the scope. ISO 19011:2026, published in May 2026 according to the ISO committee page, provides guidelines for conducting an audit, second-party audits included.
Sequence | What the auditor does | Why |
|---|---|---|
Opening meeting | Restates the objective, scope, criteria and confidentiality | No misunderstanding about what is audited |
Goods receipt and storage | Checks the raw materials and packaging of your product, their status and identification | Right batches, right packaging versions |
Changeover | Observes the switch from another customer’s run to yours | Line clearance is seen, not read |
Production and packing | Follows your product, station by station, with the operators | Recipe, parameters, in-process controls |
Interviews | Line supervisor, quality, warehouse, maintenance | What is actually done |
Record review | Recent batches of your product | Consistency over time |
Traceability exercise | A batch of your product, chosen on the day | Link between finished product, raw materials and packaging |
Closing meeting | Presents the findings and their severity | No surprises in the report |
For an outsourced step that comes back to your plant, add two stops: dispatch to the subcontractor and the return, with the identification, protection and temperature of the product in transit.
Which checks are specific to your product?
The ones no certification audit will do for you, because they concern your contract. FSSC 22000 Version 7 provides several useful reference points, even when the co-packer holds a different standard.
- The recipe: the version used is the one in your specification, and any change has been approved by you.
- The materials: the batches used come from suppliers approved or prescribed in the contract.
- The critical step: process schedule, temperature, time or dosage compliant, recorded and verified.
- Artwork and print run: the artwork on the line is the latest approved version, each print run has been approved against the master and obsolete versions are destroyed (FSSC 22000 v7, 2.5.2 d).
- Changeover: labels and packaging from the previous run have been removed from the line (2.5.9 c).
- Allergens: the cross-contamination risk from other customers’ products has been assessed and, where products with different allergen profiles share an area, verification testing is carried out at a risk-based frequency (2.5.6 d); precautionary labelling is justified only by the risk assessment (2.5.6 e).
- Quantity: weight or volume controlled, equipment calibrated (2.5.9 b).
- The claim: for an origin or a free-from allergen claim, evidence of validation, traceability and mass balance (2.5.2 c).
- The return: for an outsourced step, inspection and testing of the product on its return, at a risk-based frequency (BRCGS 3.5.4.6).
How do you write the report and follow up the actions?
As a document other auditors will read. BRCGS requires a certified site that relies on a second-party audit to be able to demonstrate the auditor’s competency, confirm that the scope covers product safety, traceability, HACCP review, the product security and food defence plan, the product authenticity plan and good manufacturing practices, and obtain and review a copy of the full audit report (3.5.4.2).
Each finding cites the requirement or the contract clause, the evidence observed and its severity on the agreed scale. The conclusion answers the scoping question. Follow-up matches the evidence: documentary evidence can be checked remotely; when the finding concerns a practice, such as line clearance, only a new visit can verify it. The result feeds your subcontractor review, held at least once within a 12-month period under IFS Food (4.4.7).
Three mistakes cause most of these audits to fail: coming on a day when your product is not running, auditing the co-packer’s system instead of your product, and closing a finding on a promise rather than on dated evidence.
The final checklist, to keep for every audit:
For a worked example covering two subcontractors, read our case study of a Moroccan biscuit maker.