Second-Party Food Audit: Auditing Co-Packers and Subcontractors

What is a second-party audit at a co-packer or a subcontractor?

It is the audit that a brand owner, or a site that hands over a step of its manufacturing, carries out at the company that makes the product for it. The commissioning company is not buying a raw material: it entrusts its product, its recipe and often its label. The audit checks that this third party meets the contract and the specification with the same guarantees as if the product came off the brand owner’s own lines.

It is not the classic supplier audit described in our guide to supplier audits in Morocco, where a buyer approves a supplier that sells its own products. Here, the product is yours. Your name is on the pack, and your customer, whether a retailer or a manufacturer, will turn to you if something goes wrong, not to the co-packer.

Two situations are common in the Moroccan food industry, for Moroccan and European brand owners alike, and the standards treat them differently:

• full contract manufacturing, or co-packing: a third party makes, packs and labels a finished product under your brand or your customer’s brand, for example a retailer’s private label;
• outsourced processing: an intermediate step leaves your plant and comes back, such as depositing a filling, freezing, slicing or primary packing.

FSSC 22000 Version 7 carries the ISO 22000:2018 definition in its definitions appendix: to outsource is to make an arrangement where an external organization performs part of an organization’s function or process. The table shows where each standard places the two situations.

What do BRCGS, IFS and FSSC 22000 say about outsourced processes?

The same logic, in four steps: declare the outsourcing, approve the subcontractor based on risk, put the service in writing, check the product. The standards differ in their vocabulary and in what your own certificate covers.

BRCGS Food Safety Issue 9: clause 3.5.4

The official English checklist, F904A, defines outsourced processing, also called subcontracted processing, as an intermediate step: the product leaves the audited site, then returns to it. Six requirements apply:

• 3.5.4.1: the outsourced step has been declared to the customer and, where required, approval has been granted;
• 3.5.4.2: outsourced processors are approved and monitored based on risk, through a valid certification to a BRCGS or GFSI-benchmarked standard whose scope includes the activities completed for the site, or through a supplier audit whose scope covers product safety, traceability, HACCP review, the product security and food defence plan, the product authenticity plan and good manufacturing practices;
• 3.5.4.3: the risks of the outsourced step form part of the site’s food safety plan (HACCP plan);
• 3.5.4.4: the requirements are agreed and documented in a service specification, similar to a finished product specification;
• 3.5.4.5: the operation follows established contracts that clearly define the processing requirements, and product traceability is maintained;
• 3.5.4.6: inspection and test procedures, visual, chemical or microbiological, check the product on its return, at a frequency based on risk assessment.

Two clarifications in the same checklist prevent scoping errors. A product that leaves the site and does not return to it is not outsourced processing under 3.5.4: the activities completed off site are outside the scope of the audit. And off-site packing of products also appears among the suppliers of services to approve and monitor (3.5.3.1).

IFS Food Version 8: requirements 4.4.4 to 4.4.7

The IFS Food Version 8 standard calls a partly outsourced process any production step or part of a production process, primary packing and labelling included, carried out off site by a third party on behalf of the certified site. This includes a sister company in the same group, and applies to the site’s own brands as well as its customers’ brands. The test is ownership: a raw material is purchased, whereas a product from a partly outsourced process always belongs to the audited site.

The site must document the outsourcing in its management system and control it (4.4.4), implement an agreement covering in-process controls, testing and monitoring plans (4.4.5), approve the supplier through IFS Food or other GFSI-recognised certification, or through a documented supplier audit performed by an experienced and competent person (4.4.6), and review its supplier assessments at least once within a 12-month period (4.4.7). The site’s certificate carries the sentence “Besides own production, the company has partly outsourced processes.”

Fully outsourced products, made, packed and labelled under your brand by another production site, are not covered by IFS Food. IFS recommends certifying them under IFS Broker or an equivalent GFSI-recognised standard.

FSSC 22000 Version 7: ISO 22000 and the scheme annexes

The FSSC 22000 Version 7 scheme, published in May 2026, is built on ISO 22000:2018. Its annexes set two rules that matter to a brand owner. The certificate scope does not include subcontracted or outsourced processes outside the organization’s legal responsibility and control; ISO 22000:2018 clauses 7.1.6 and 8.1 still apply, and objective evidence is recorded in the audit report. That report must detail the outsourced processes: how their impact on food safety is assessed, which criteria apply to selection, evaluation, monitoring and re-evaluation, and how effectiveness is verified.

Additional requirement 2.5.1, management of services and purchased materials, adds to ISO 22000:2018: laboratory analyses that verify a parameter critical to food safety are entrusted to a competent laboratory and performed in accordance with the applicable requirements of ISO/IEC 17025. What changes with Version 7 is summarised in our article on food outsourcing requirements in 2026–2027.

Is the co-packer’s certificate enough, or do you need to audit?

It is enough when its scope covers exactly the activity carried out for you and your product carries no risk the standard does not address. BRCGS and IFS accept it as a route to approval. But three limits make the audit common for a product under your brand.

The certificate does not name your brand. IFS Food Version 8 does not allow brand information in a certificate scope, and FSSC 22000 Version 7 excludes brand names too, as they might suggest product certification. The certificate therefore never says whether your product is made on the certified line, or to your recipe.

The certificate attests a standard, not your contract. Your recipe, your artwork, your allergen profile and your release criteria are not in the certification body’s checklist.

The certificate has a date and an address. A line moved to another site, an FSSC 22000 v7 upgrade still to come or a suspension can be checked in the BRCGS Directory, the IFS Database or the FSSC Public Register.

The certificate may be enough if all of these conditions are met:

• The certificate is valid and checked in the standard owner’s official database.
  
• Its scope covers the activity and the address where your product is made.
  
• Your product carries no claim, no allergen absent from the site’s other products and no critical step specific to your recipe.
  
• The contract and the service specification are signed and up to date.
  
• Your checks at receipt or on the product’s return are defined and applied.
  
• Your customer accepts, in writing, approval based on the certificate.
  

If you choose the audit, BRCGS sets the bar. When the audit is carried out by a second or third party, the site must be able to demonstrate the auditor’s competency, confirm that the audit scope covers the six topics of 3.5.4.2 and obtain and review a copy of the full audit report. A one-page report will not satisfy your own certification auditor.

What scope and criteria for a subcontractor audit?

The scope is what the contract hands over: products, lines, addresses and steps. The criteria are what you have written down, contract and specification, plus what your own standard requires of you. The table links each criterion to its source.

In Morocco, the first criterion is regulatory. The sanitary authorisation or approval issued by ONSSA, Morocco’s national food safety office, must cover the subcontractor’s establishment and the activity it carries out for you. No certification replaces it.

A typical case: a spice brand in the Casablanca region hands the microbial reduction of its blends to a nearby site, then packs them itself. Under BRCGS, this is outsourced processing. The audit looks first at the validation of the step, its records and the identification of batches on return, then at the tests set out in the brand’s own HACCP plan.

The audit itself, from questionnaire to report, is described in our step-by-step guide on how to prepare and conduct a co-packer audit.

How often should you audit, and what do you decide afterwards?

Based on risk, with a review at least once a year and a new audit at each significant change. IFS Food Version 8 requires supplier assessments to be reviewed at least once within a 12-month period or whenever significant changes occur (4.4.7); BRCGS requires a documented, risk-based process for ongoing supplier performance review (3.5.4.2). To organise the programme, ISO 19011:2026, published on 27 May 2026 as the 4th edition according to the ISO committee page, gives guidelines for managing an audit programme and applies to first-, second- and third-party audits.

A new audit is needed when:

• a new product, recipe or format is handed to the subcontractor;
• production moves to another line or site, or a new allergen enters the plant;
• the certificate status changes: suspension, withdrawal, change of version;
• a complaint, a withdrawal or a test result calls the outsourced product into question;
• your customer asks for it, or is preparing its own audit at your site.

The audit does not decide: the brand owner decides, based on the report.

What drives the duration and the budget is covered in our article on subcontractor audit cost.

Who should audit a co-packer: what competence, what impartiality?

An auditor who knows the subcontractor’s standard, the trade being audited and your product, and who has no stake in the outcome. BRCGS requires an experienced and demonstrably competent product safety auditor; IFS Food Version 8, an experienced and competent person. ISO 19011:2026 provides the framework for evaluating auditor competence.

Four questions are enough to judge an auditor. Do they know the current version of the standard the subcontractor holds? Have they audited this trade: biscuits, canning, dairy? Do they speak the operators’ language, often Arabic or French in Morocco? Will their report satisfy your certification body’s auditor and your customer’s auditor?

On impartiality, the rule fits in one line: the auditor signs a declaration of no conflict of interest with the audited site. ACG advises and audits, but never certifies a site it has advised. ACG’s founder, Dr. Ismail Idrissi, is the only BRCGS-registered consultant in Africa, according to the BRCGS list of consultants. An IRCA-certified QHSE Lead Auditor and an IFS Food and BRCGS auditor, he also audits as a third party for Eurofins and URS in Morocco, West Africa and the MENA region; he never carries out a certification audit at a site ACG has advised.

Before appointing an auditor for your subcontractors, check these points:

• The auditor’s qualifications and experience of the audited trade are documented.
  
• The auditor knows the standard and the version the subcontractor holds.
  
• A declaration of no conflict of interest with the site has been signed.
  
• The audit scope covers the topics your own standard requires.
  
• You will receive the full report, in your customer’s language if needed.
  
• The form of the recommendation is agreed before the audit.
  

A worked example shows the sequence: in our case study of a Moroccan biscuit maker, the brand audits two subcontractors, one making a private label product, the other depositing a filling, before its retail customer’s audit.