Does your business really fall under IFS Broker?
Yes, if you buy and resell without handling the goods. The IFS Broker version 3.2 standard covers brokers, sales agents, traders and importers, whether or not they own the products, that typically do not take physical possession of them: no warehouse, no packing station, no truck fleet. The trade can involve food, household and personal care products, or packaging materials.
Take a Casablanca trader that buys canned sardines from two canneries in Agadir and Safi, and spices and pulses from local packers, then resells them to European importers, sometimes under a retailer’s brand. Before any preparation, check that your situation really fits the standard.
Your situation | IFS Broker 3.2 rule | What you need to decide |
|---|---|---|
Office only, goods shipped directly from supplier to customer | Core of the standard | Scope: all products traded |
Own warehouse where goods pass through | Not covered by IFS Broker alone | Combined IFS Broker and IFS Logistics audit, or the statement “logistics activities not certified” |
Transport or storage contracted to a service provider | Requirement 4.8.1 | A contract that sets the requirements, or a provider certified to IFS Logistics or a GFSI-recognised standard |
A marginal product range you would like to leave out | Exceptional exclusion, by whole product scope, never for the core business | Certification body agreement, statement on the certificate |
Retailer-brand products | Exclusion not allowed | Include them in the scope |
The scope covers all the company’s broker services, and the audit only takes place when those activities can be assessed in operation. If you also process products, start with our IFS Logistics, IFS Broker and IFS PACsecure guide.
How does the auditor run an IFS Broker audit?
By following products, not by reading a manual. The protocol asks the auditor to choose sample products and use their specifications as the common thread: for example a customer-brand product, an own-brand product, one sold in small quantities and another in large quantities. If the trading of these products has respected their specifications, the company’s compliance is generally established.
The audit follows a set sequence: opening meeting, document review (risk management, specifications, test results), a traceability test on a product chosen by the auditor, a walk-through and staff interviews, then the closing meeting. Senior management is recommended to attend both meetings.
A few practical rules to know:
- Duration: at least six hours. The certification body extends it according to the type of broker services, the number and volume of products traded, the number of origin and destination countries, the headcount and the findings of the previous audit.
- Location: the official IFS Broker fact sheet allows an on-site or a remote audit, if both parties agree and the digital tools allow it.
- Language: under the IFS Broker 3.2 doctrine, version 3, interpreters are not allowed if the working language is French; for another language, an independent interpreter adds 20% to the duration.
- Notice: the unannounced audit is an option, to be requested no later than four weeks before the audit time window opens.
- Frequency: one audit every twelve months, calculated from the audit date.
How do you prove control of your suppliers?
Through a risk-based approval procedure and dated evidence. This is chapter 4.4, “Purchasing”, and it is where most traders discover their gaps.
The approval and monitoring procedure (4.4.2 and 4.4.3) must rest on a hazard analysis, with clear criteria: audits, certificates of analysis, supplier reliability and complaints, fraud included, and required performance standards. The version 3 doctrine adds that this assessment must also cover malicious threats (product defence).
Requirement 4.4.4 weighs the most: the supplier shall be certified against an IFS standard or another GFSI-recognised standard covering its activity. For a trader that buys from small, uncertified producers, the text leaves one exception: the customer’s express acceptance. The doctrine says what counts as evidence: a signed specification or contract, an email confirmation, a letter of acceptance. A generic sentence in your terms and conditions is not considered good trading practice and is scored as a deviation.
Prepare the rest of the chapter with the same rigour:
- monitoring of sourcing areas (4.4.5), through an internal or external risk-based system;
- regular assessment of suppliers and service providers, with the resulting actions recorded (4.4.6);
- checks on purchased products against specifications and, depending on the risks, for authenticity (4.4.7); where a supplier’s status is missing, the doctrine asks for more frequent and wider product testing, and for the exceptional situation to be justified;
- supplier validation according to customer requirements for retailer-brand products (4.4.8);
- a food fraud vulnerability assessment for all purchased products, packaging included, with the related mitigation plan (4.7);
- protection against malicious acts at suppliers and logistics service providers (chapter 6).
For a Moroccan supplier, the standard file holds its IFS or GFSI certificate and scope, its sanitary approval or authorisation from ONSSA (Office national de sécurité sanitaire des produits alimentaires, Morocco’s food safety authority) for the products bought, the signed specification, the latest certificates of analysis and the annual assessment form. IFS Broker asks traders to take into account the legal requirements of both the production and the destination countries.
Which product specifications does the auditor expect?
Specifications for all products, up to date, unambiguous and compliant with the law of the destination country and with customer requirements (4.2.1). Compliance with customer specifications is a KO requirement (4.2.2): it is the first thread the auditor pulls on the sample products.
What the auditor checks in practice:
Requirement | What the auditor asks for | Typical gap |
|---|---|---|
4.2.3 and 4.2.4 | Specifications formally agreed by the customer where required; a procedure for creating, changing and approving them | The supplier’s technical sheet copied over, never approved by the customer |
4.3.5 | Labelling that complies with the law of the destination countries and with customer requirements | A label in French for a German customer, allergens not checked |
4.5.1 and 4.5.2 | Packaging specifications and suppliers’ declarations of compliance | No declaration for the cans or the pouches |
5.2.2 (KO) | Analyses demanded by the customer written into a testing plan, with results available | Tests run by the supplier, never collected |
5.2.3 | Safety analyses preferably by a laboratory accredited to ISO/IEC 17025 | The supplier’s in-house laboratory, with no comparison |
For products under your own brand or a customer’s brand, chapter 4.3 adds product development: recipe, shelf life, sensory tests, usage recommendations. If the customer defined everything, you must prove that each characteristic is met.
How do you test traceability and recall before the auditor does?
By running the auditor’s test yourself. The traceability system is a KO requirement (4.6.1): it must link the supplier, identified down to the lot, to the delivery to the customer. The test (4.6.2) is run at least once a year and whenever the system changes, upstream and downstream, logistics activities included, with a quantity check. The doctrine specifies that the rule also applies to bulk products and to consumer units without a final consumer label.
A useful test is prepared like a real exercise: a lot of chickpeas delivered to Rotterdam, traced back to the packer’s lot, with the quantities bought, sold and still in stock at the service provider, and the time it took. The recall test (5.5.4) is also run at least once a year. The withdrawal and recall procedure is a KO (5.5.2): it informs the customers concerned immediately and sets out who does what. Someone able to trigger crisis management must be reachable at all times (5.5.3).
Finally, the certification body must be informed within three working days of a recall (1.2.7). The version 3 doctrine specifies that this also covers withdrawals for product safety or fraud reasons when the trader is legally responsible for the product, and authority visits that result in mandatory action.
Which checklist should you follow in the weeks before the audit?
This one covers the eight KO requirements and the points the auditor checks first.
Three mistakes to avoid: showing suppliers’ certificates without checking that their scope covers the products bought; confusing the supplier’s technical sheet with the specification approved by the customer; testing traceability on an easy lot chosen in advance. A mock audit brings these weaknesses to light in time: see our audits and inspections. The budget and timeline of such a project are covered in IFS Logistics certification cost, Broker and PACsecure compared.