What is the starting point of this case study?
A food group whose customers are asking for evidence about its suppliers. This is a composite case study: it brings together situations encountered in our training and supplier audit assignments. The group, its sites, its suppliers and its customers are fictitious, and the case contains no amounts.
The group has three sites: a biscuit factory in the Casablanca region, a confectionery plant in Kenitra and a dried fruit packing unit in the Souss region. Two sites are FSSC 22000 certified and are preparing their upgrade to Version 7; the third is preparing for certification. Purchases cover flours, sugars, fats, dried fruit, flavourings, films and cartons, as well as services: cleaning, pest control and refrigerated transport.
Until then, supplier approval relied on a questionnaire, a copy of the certificate and, for Moroccan suppliers, proof of their sanitary approval or authorisation by ONSSA, the Office national de sécurité sanitaire des produits alimentaires (Morocco’s national food safety office). A British customer and a European retailer asked for more: a risk-based evaluation programme, with on-site audits of sensitive suppliers. The group decided to carry out most of these audits itself and to entrust their leadership to its QHSE manager, a food engineer who had been an internal auditor for several years.
Why a Lead Auditor course rather than an internal auditor course?
Because leading an audit at a supplier is not auditing your own system. The relationship is contractual, the auditee is another company, and a finding can lead to a product reference being suspended. The QHSE manager knew how to audit; she needed to learn to lead an audit, and a team, away from her own site.
Need of the group | What her internal auditor training provided | What the Lead Auditor course added |
|---|---|---|
Prepare an audit at a third party | An audit plan for an internal process | Objectives, scope and criteria agreed with the auditee; plan sent in advance |
Lead a small team | Audits conducted alone or in pairs | Allocation of roles, including a technical expert, and running the meetings |
Write findings that hold up | Gaps understood internally | Findings based on the requirement, the fact and the evidence, defensible in front of the supplier |
Conclude and follow up | Follow-up of internal actions | Audit conclusion, proposed approval decision, verification of the effectiveness of actions |
The choice of standard followed the risks. The most sensitive suppliers delivered ingredients and food-contact packaging, so she chose a food safety (FSMS) Lead Auditor course, based on ISO 22000:2018. For service providers, the same audit method applies, with criteria drawn from the group’s specifications.
Before enrolling, she checked three points: the reference of the certified course on the CQI website, the exam language and what the price included. Our guide to the IRCA Lead Auditor course in Africa details these checks.
How did she prepare, and how was the course funded?
Through four weeks of preparation and early inclusion in the training plan. She first reread ISO 22000:2018 clause by clause, then ISO 19011:2026, the fourth edition published on 27 May 2026 according to the ISO page, which also covers second-party audits. She then audited a process on her own site with a checklist, wrote five findings and had them reviewed. The method is described in our article on Lead Auditor exam preparation.
On the funding side, the human resources department included the course in the year’s training plan before the session. It could therefore be submitted under the special training contracts (contrats spéciaux de formation, CSF) of OFPPT, the Office de la formation professionnelle et de la promotion du travail (Morocco’s vocational training office), as planned training delivered by an external provider: 70% under the reference rule, against 40% for unplanned training, within a ceiling calculated on the group’s declared vocational training tax (TFP), under the CSF procedures manual of May 2006 and its Amendment No. 2 of 2 June 2014. This calculation was indicative, before ceilings, with no commitment. The other budget items are detailed in our article on Lead Auditor course cost.
As the only participant from her company, she attended a public session. After the course, she opened an audit log and planned to apply for listing on the IRCA register once her audit experience was sufficient.
How was the supplier audit programme built?
By starting from the risks, family by family, rather than from the list of suppliers. The programme separates what justifies an on-site audit from what a document review is enough to cover, and it is reviewed every year.
Supplier family | Main risk | Evaluation method chosen |
|---|---|---|
Dried fruit, fats | Allergens, contaminants, fraud | On-site audit before approval, then according to results |
Flours, sugars | Foreign bodies, contaminants | Valid certificate under a GFSI-recognised scheme and questionnaire; audit in case of incident |
Food-contact films and cartons | Migration, foreign bodies, hygiene | On-site audit if the supplier is not certified to a packaging standard |
Flavourings | Allergens, regulatory compliance | In-depth document review; audit if the supplier is new |
Cleaning, pest control, refrigerated transport | Practices on the group’s sites | Remote document review, then observation of one service visit |
Three rules were set from the start:
- The audit team is impartial. The QHSE manager leads the audit; a research and development technician acts as technical expert; the buyer attends the opening and closing meetings as an observer, without taking part in the findings.
- The criteria are written before the audit. Group specifications, requirements of the customers concerned, applicable regulations: the supplier receives them with the audit plan.
- The documentation is reviewed before the visit. Part of the document review is done remotely, so that time on site goes to the workshops, the stores and the interviews.
For packaging suppliers, which she knew less well, the first two audits were conducted with an experienced external auditor. That is also how she began filling her audit log with paired audits.
What results, and what difficulties, in the first year?
Better-known suppliers, concrete findings, and an underestimated workload. The audits mainly found specifications that had not been updated, traceability tests that were too slow, fragile allergen management on shared lines and incomplete pest control records.
Two difficulties marked the year. The first concerned how findings were received: some suppliers, used to certification audits, disputed gaps raised against the group’s specifications. The rigorous writing learned during the course (requirement, observation, evidence) settled most of these debates. The second concerned time: preparation, travel, reporting and follow-up of actions took far more days than planned, at the expense of the sites’ internal audits.
The group drew two decisions from this: train a second Lead Auditor, included in the next training plan, and entrust audits of distant suppliers, in Europe and West Africa, to an external provider. Our supplier audit guide for EU and UK buyers sets out what European buyers expect from these audits.
What a group in Morocco or elsewhere in Africa can take from this case: