Subcontractor Audit Cost: What Drives a Co-Packer Audit Programme

What drives the cost of a subcontractor audit programme?

Five decisions the brand owner takes before the first audit, then the auditor’s rate. The factors behind supplier audit programmes in general are covered in our article on what drives the cost and duration of a supplier audit programme; those below are specific to co-packers and outsourced processes.

How many co-packers and products need auditing?

Every subcontractor whose certificate does not cover the activity, and this is where outsourcing costs more than purchasing. For a raw material, BRCGS Food Safety Issue 9 accepts a completed questionnaire for the initial approval of suppliers assessed as low risk, with a valid risk-based justification (3.5.1.2). For an outsourced processor, clause 3.5.4.2 of the official English checklist, F904A, provides only two routes: a valid certification to a BRCGS or GFSI-benchmarked standard whose scope includes the activities completed for the site, or an audit. The IFS Food Version 8 standard sets the same alternative (4.4.6).

The first saving, then, is to check certificates in the BRCGS Directory, the FSSC Public Register or the IFS Database, and to compare their scope with what the contract hands over. The second is to group: a well-scoped audit covers all your products made on the same line, and a single audit plan can cover a filling step and packing if both take place at the same address.

Watch out for cascade subcontracting. A co-packer that itself hands storage, a test or a process step to a third party adds a link to check, at least on paper.

How does risk set the depth and frequency?

Risk decides the format of the audit, its scope and its rhythm; the site and the scope decide its duration. To rate a subcontractor, tick the criteria that apply:

• The step entrusted is a control measure in the HACCP plan: cooking, sterilisation, a filling, modified atmosphere packing.
  
• The product is made under your brand or under a retailer’s private label.
  
• The product carries a claim: origin, free from an allergen, production method.
  
• The co-packer handles, for other customers, allergens absent from your recipe.
  
• The co-packer prints your labels or your coding.
  
• The subcontractor holds no GFSI-recognised certification for the activity entrusted.
  
• The subcontractor is new, or has changed site, line or certification.
  
• Complaints, returns or adverse test results concern the product.
  

The more boxes ticked, the more an on-site audit is justified, the longer it lasts and the sooner it comes back. IFS Food Version 8 requires supplier assessments to be reviewed at least once within a 12-month period or whenever significant changes occur (4.4.7): the review is annual, the on-site audit follows the risk.

On site or remote: where are the real savings?

In preparation and follow-up, not in observation. The document review, the examination of certificates, HACCP plans and procedures, then the checking of closure evidence work well remotely, provided the subcontractor keeps digital records. What protects your product can be seen in production: line clearance between two customers, the condition of the premises, the storage of obsolete artwork, the segregation of allergenic materials.

For a programme in Morocco, three real savings:

1. Time the visit to the production schedule of your product, rather than coming back another day.
2. Group visits by region when your subcontractors are close to one another, for example around Casablanca, Fez or Agadir.
3. Follow up remotely the findings whose evidence is documentary, and keep the follow-up audit for practice findings.

Why does auditor competence change the budget?

Because an audit that does not meet your standard’s requirements has to be redone. BRCGS requires the audit of an outsourced processor to be undertaken by an experienced and demonstrably competent product safety auditor. When it is carried out by a second or third party, the site must be able to demonstrate that competency, confirm that the scope covers product safety, traceability, HACCP review, the product security and food defence plan, the product authenticity plan and good manufacturing practices, and obtain the full report. IFS Food Version 8 requires an experienced and competent person.

Competence also affects duration. An auditor who knows the trade, whether biscuits, canning or dairy, targets the risk points without discovering them on site. An auditor who speaks the operators’ language, Arabic or French in Morocco, avoids interpreting. An auditor who writes in your customer’s language avoids translation. ISO 19011:2026, the 4th edition published in May 2026 according to the ISO committee page, provides the framework for evaluating that competence, for second-party audits as for any other.

How do you control the budget without weakening control?

By spending on-site audit time where it protects your product, and standardising the rest. The substantive decisions, approve, continue with conditions or suspend, are described in our guide to the second-party food audit; on the budget side, five levers are enough:

1. Write the contract and the service specification before the audit: a clear criterion shortens the visit and the debate over findings.
2. Use one checklist per type of outsourced step: full manufacturing, filling, packing, storage.
3. Require the full report from the first assignment, in the format your certification body and your customer expect.
4. Track subcontractors in a single tool: reports, findings and action status are available subcontractor by subcontractor in your Inspirra client space.
5. Train your own auditors for routine audits, and keep an external auditor for critical or distant subcontractors. In Morocco, this training may fall under the special training contracts of OFPPT: the rule and a simulation are on our CSF OFPPT funding page, with no promised amount.

For the audit method itself, see our guide on how to prepare and conduct a co-packer audit.