IFS Food Version 8: The 10 KO Requirements That Fail Audits

What is a KO requirement in IFS Food Version 8?

A KO ("knock-out") requirement is one that IFS treats as essential: if it is not implemented, the audit fails. IFS Food Version 8, mandatory since 1 January 2024, defines ten of them.

The difference from a regular requirement lies in the scoring. A regular requirement can be scored A, B, C or D, or receive a Major non-conformity. A KO requirement has only three possible scores: A (full compliance), B (a small part is not implemented, with no impact on food safety, legality or customer requirements) and D (not implemented). There is no C.

A D on a KO is a KO non-conformity. It subtracts 50% of the total possible points and the certificate cannot be issued. A plant that scores A everywhere except traceability is not certified.

For an exporter in Morocco, Egypt, Kenya or Côte d'Ivoire, the stakes are commercial as much as technical. When a recertification audit fails, the current certificate is withdrawn from the IFS Database within two working days, and every database user who follows your site receives an e-mail explaining why, requirement number included. Your buyers know before you have finished reading the report.

What are the 10 KO requirements of Version 8?

The ten KOs cover the control chain end to end: who is accountable, how hazards are monitored, and how product is specified, traced and recalled. The table follows the official list in Part 1 of the standard and shows the first evidence an auditor asks for.

Two details matter. First, N/A is not allowed for KO numbers 1, 3 and 5 to 10; only KO 2 (no CCP) and KO 4 (no customer agreement of that type) can be N/A, with a justification in the report. Second, several regular requirements extend the KOs and are checked at the same time. Clause 4.18.2 requires a traceability test, including mass balance, at least once every 12 months, and clause 4.18.3 sets a four-hour maximum to trace from finished product back to raw materials and forward to customers.

Which mistakes most often trigger a KO?

KOs rarely fail because a document is missing. They fail because what the auditor sees on the floor contradicts the document. These are the patterns our consultants and auditors meet most often in Moroccan and African plants; the list is qualitative, drawn from our assignments, not from a published statistic.

Management commitment (KO 1)

The policy is signed and the organisation chart is on the wall, but a shift leader cannot say what to do when something goes wrong. The clause asks for more than awareness: it asks for documented mechanisms that check awareness works. Without reviewed indicators or recorded floor observations, there is no evidence.

CCP monitoring (KO 2)

In a sardine cannery, the classic failure is a retort record filled in at the end of the shift, all in the same ink, with suspiciously regular values. In a biscuit or dried fruit line, it is a metal detector check that was done but with no recorded action when a test piece was not rejected. A limit exceeded without a recorded action is enough for a D. Our guide to the HACCP plan with a cannery example walks through CCP design.

Personal hygiene (KO 3)

Operators follow the rules, but the external maintenance technician, the driver or the customer's visitor walks into the production area without protective clothing or hand washing. The KO explicitly covers "personnel, contractors and visitors". Clause 3.2.3 also requires compliance checks at least once every three months.

Customer agreements and specifications (KO 4 and KO 5)

For private label products, the retailer's specification sets a recipe, a label or a testing plan, and the plant produces to an older internal sheet. That is common among co-packers working for several European retailers at once. On KO 5, specifications exist for the main ingredients but not for packaging, additives or rework, or they do not match the law of the destination country.

Foreign material and traceability (KO 6 and KO 7)

The glass and brittle plastic register is not kept up to date, wooden pallets enter the production area, or a lot stopped at the metal detector is shipped without a recorded decision. On traceability, the test works on paper until the auditor picks a lot that contains rework, or printed packaging from two deliveries, and the link breaks. The mass balance does not reconcile, or the trace takes longer than four hours.

Internal audits, recalls and corrective actions (KO 8, 9 and 10)

The internal audit programme does not cover every IFS requirement over twelve months. The recall procedure has never been tested end to end, although clause 5.9.2 requires a test planned within 12 months and executed within 15. Corrective actions stop at the immediate correction, with no root cause, no owner and no deadline.

How are the score and certificate level calculated?

The result of an IFS Food audit is a percentage: points awarded divided by the total possible points. Each applicable requirement is worth up to 20 points; N/A requirements are excluded from the calculation.

The certificate level then depends on the score and the non-conformities, as set out in Part 1 of the standard:

• 95% or more, no non-conformity: higher level certificate, valid for 12 months.
• 75% to below 95%, no non-conformity: foundation level certificate, valid for 12 months.
• One Major only, with a score of at least 75%: follow-up audit within six months; foundation level certificate if the Major is effectively resolved.
• More than one Major, at least one KO scored D, or a score below 75%: failed audit. A full new initial audit no earlier than six weeks later.

In every case, the certificate is issued only once corrections are implemented. The certification body sends the action plan within two weeks of the audit; the site has four weeks to return evidence of corrections and proposed corrective actions.

How do you prepare for an unannounced IFS Food audit?

Assume the audit can start on any day of the window. Since 1 January 2021, at least one IFS Food audit in three is unannounced. It takes place within a window from 16 weeks before to 2 weeks after the audit due date, with no notice of the date.

The standard is explicit: every requirement must be implemented before the window opens. The certification body tells the site in which year the first mandatory unannounced audit will fall, at least six months before the audit due date. A site audited unannounced earns the "IFS Star" status, shown in the IFS Database and on the certificate.

In practice, for a plant in Africa, three things change:

1. Availability. Name deputies for the quality manager and the site manager. The audit will not be moved because someone is away.
2. Seasonality. If the window falls in peak season (sardines, citrus, tomatoes, cocoa or cashew processing), the auditor will see the plant at full capacity, with seasonal workers. That is when KO 2 and KO 3 are most exposed.
3. Routine. CCP records, hygiene checks and traceability tests must be kept every day as if they would be read the next morning.

How do you secure the ten KOs before the audit?

Audit them yourself, one by one, on the floor and not only on paper, at least three months before the window opens. A GFSI mock audit run by an outside auditor gives you the same reading as the certification body. This is the checklist we use.

• KO 1: interview five employees from different roles about their food safety responsibilities; check the indicators reviewed by management.
  
• KO 2: read one month of records for every CCP; check that each limit exceeded has a recorded action.
  
• KO 3: watch a contractor and a visitor enter the plant; check the quarterly personal hygiene compliance check.
  
• KO 4: for each private label customer, compare its specification with the production sheet and the current label.
  
• KO 5: list every raw material, packaging item and rework stream; check each has a current, legally compliant specification.
  
• KO 6: check the glass and brittle plastic register, wood control and the fate of products stopped at the detector.
  
• KO 7: run a traceability test on a complex lot (rework, several packaging lots) and time it against four hours, mass balance included.
  
• KO 8: check the internal audit programme covers every IFS requirement over twelve months.
  
• KO 9: check the date of the last end-to-end recall test and the emergency contact list.
  
• KO 10: take three recent deviations and find, for each, the root cause, corrective action, owner, deadline and effectiveness check.
  

If you are still choosing between IFS, BRCGS and FSSC 22000, our comparison of GFSI standards by export market will help. If the buyer is coming to audit you directly, read our article on supplier audits in Morocco and Africa.