Supplier Audit in Morocco: How EU and UK Buyers Qualify Suppliers

What is a supplier audit, and how does it differ from certification?

A supplier audit is a second-party audit: it is commissioned by a customer, or carried out on its behalf, to check that a supplier meets that customer’s requirements. It issues no certificate. It produces a report for the buyer, who then decides to approve, suspend or reject the supplier.

The ISO 19011 guidelines for auditing management systems, published by ISO, separate three families of audit. The distinction matters because a Moroccan or West African exporter often goes through all three in the same year: its own internal audit, its certification body’s audit and visits from one or more customers.

Supplier audits come in several forms: approval audits before a first contract, periodic surveillance, audits after a complaint or recall, audits of a co-packer producing under your brand, audits of a tier-2 subcontractor. The method is the same; scope and depth change.

Do not confuse a supplier audit with a mock audit, which many sites book a few weeks before certification. A mock audit is a first-party audit run by an outsider for the site’s own benefit. We explain it in our article on the GFSI mock audit for BRCGS, IFS and FSSC.

Why audit a supplier that is already certified?

Because a certificate answers a general question, “does this site control product safety?”, while you need specific answers: this product, on this line, to my specification, with my social requirements and my volumes. The supplier audit closes that gap.

One of the aims of the GFSI is to cut duplicate audits: a buyer who accepts a recognised certificate can lighten its own audit or focus it on what the certificate leaves out. It does not always remove it. Five reasons come up most often.

• Your legal responsibility as importer. In the European Union, Regulation (EC) No 178/2002 requires imported food to comply with EU food law (Article 11), puts primary responsibility on food business operators (Article 17) and requires each operator to identify its direct suppliers and customers (Article 18). If you place a product from Morocco on the EU market, you need to show how you qualified the supplier.
• The real scope of the certificate. A certificate covers specific products, processes and one site. A new SKU, an added line, an external warehouse or a subcontractor may sit outside it.
• Your own requirements. Specification, retailer code of practice, private-label rules, analytical limits tighter than the law, labelling rules of the country of sale.
• What food safety standards do not cover. Labour conditions, occupational health and safety, environment, business ethics, real capacity, business continuity.
• Product risk. Categories exposed to fraud, such as olive oil, spices, honey or saffron, and sensitive products, such as canned fish or soft fruit, justify a direct look on the shop floor.

Which GFSI standard to require depends on your market: UK retailers mostly ask for BRCGS, German and French retailers for IFS Food, multinational manufacturers for FSSC 22000. Our comparison of BRCGS, IFS and FSSC 22000 by export market sets out the map.

Why use an auditor based in Morocco or West Africa?

Because a local auditor is deployed faster, understands the regulatory context and speaks the language of the workforce, which makes findings more accurate and travel cheaper. That proximity is only worth having if independence is guaranteed in writing.

What a local auditor adds

• Interviews in the workers’ language. A line operator questioned in Moroccan Arabic or French describes what actually happens. The report is written in your language: English, French or Spanish.
• Knowledge of the Moroccan framework. The auditor knows what a valid ONSSA approval or authorisation looks like, how export documents are issued and which analyses are done by local laboratories.
• Short lead times. An unannounced visit, a follow-up after a complaint or the verification of corrective actions can be scheduled in days rather than weeks.
• Seasonality. Citrus, soft fruit, tomatoes, the sardine season: a nearby auditor can come at peak production, when risks are real, not in the off-season.
• Cost. Fewer international flights, fewer days lost in transit, easier follow-up visits, including in Côte d’Ivoire, Senegal or Mauritania.

The independence conditions to insist on

Proximity creates a risk: the auditor may know the site for another reason. Before every assignment, obtain:

1. a written conflict-of-interest declaration: no recent consulting, training or internal audit work at the audited site;
2. evidence of competence in the product category: a cannery auditor must understand thermal processing and seaming, a packaging auditor migration and cross-contamination;
3. a confidentiality undertaking covering the supplier’s information;
4. acceptance of your checklist, scoring rules and report template.

What does a buyer’s audit check?

It checks that the site can keep the promises of the contract over time: food safety, specification compliance, traceability, labour conditions and capacity. The checklist is yours, but it nearly always covers these areas.

Social audits and SMETA

Many UK and European buyers ask for a social audit on top of the quality audit. The most widely used format is SMETA, the ethical audit methodology of Sedex. According to Sedex, every SMETA audit covers two founding pillars, labour standards and health and safety; the four-pillar version adds environment and business ethics. The current version is SMETA 7, released in 2024.

One point is often misunderstood: only audit companies approved by Sedex may carry out a SMETA audit. A social audit run against your own checklist is useful, but it is not a SMETA audit. Tell the supplier which of the two you require before the visit is planned.

How does the audit run, and what do you receive?

It follows the same cycle as a certification audit: preparation, on-site audit, report, follow-up of actions. The difference is that you, the buyer, set the checklist, the report format and the decision rule.

1. Briefing. Purpose (approval, surveillance, complaint), checklist, products and lines, announced or unannounced, report language, confidentiality.
2. Questionnaire and desk review. The supplier sends its certificate, last certification report, specifications and supplier list. The auditor plans the sampling.
3. Opening meeting. Scope, agenda, people to meet.
4. Shop-floor tour. Intake, storage, processing, packing, dispatch, laboratory, staff facilities, while production is running.
5. Records review and tests. CCP monitoring, cleaning, pest control, maintenance, complaints; a traceability test on a batch chosen by the auditor.
6. Interviews. Management, quality, production, maintenance, operators, and, for the social part, workers selected without management involvement.
7. Closing meeting. Findings presented and graded, supplier’s position recorded.
8. Report and follow-up. Report delivered within the agreed time, then verification of corrective actions on evidence or during a follow-up visit.

The report you receive usually contains:

• an executive summary and a recommendation (approve, approve with conditions, do not approve);
• findings graded by severity, each referenced to a checklist requirement;
• dated photos, within the limits the site allows;
• the result of the traceability test;
• the supplier’s corrective action plan, with owners and deadlines;
• points to verify at the next audit.

How should you brief a supplier audit in Morocco?

Send the auditor what you would give your own QA team: the checklist, the specification and the decision rule. A good briefing halves the questions on site and makes reports comparable from one supplier to the next.

• State the purpose: approval, surveillance, complaint follow-up, co-packer qualification.
  
• Share your checklist or the standard the audit is based on, with your scoring rules.
  
• Attach the signed specification and any customer-specific requirements.
  
• List the products, lines and sites in scope, including subcontractors and external stores.
  
• Decide announced or unannounced, and the acceptable audit window.
  
• Say whether you need a social audit to your checklist or a SMETA audit.
  
• Fix the report language, format, platform and deadline.
  
• Require the conflict-of-interest declaration and evidence of category competence.
  
• Agree how corrective actions will be verified: on evidence or by a follow-up visit.
  

Suppliers who prepare well often run a mock audit first; see our guide to the GFSI mock audit. A supplier whose HACCP plan is out of date should start there: our HACCP plan guide with a cannery example follows the Codex method.

What does a supplier audit cost, and who pays?

Cost depends mainly on days on site, scope and travel. Depending on the contract, the buyer pays, recharges the supplier or shares the cost; check the clause before signing.

There is no published standard rate. The same factors always drive the quote:

• scope: food safety only, or food safety plus social and environmental;
• site size and complexity: number of lines, products, shifts, an in-house laboratory;
• number of sites: a group with a plant, a cold store and a subcontractor needs several visits;
• mode: announced, unannounced, or combined with a follow-up;
• report format and language: your checklist, translation, an online platform;
• travel: an auditor based in Morocco cuts it for Moroccan and West African sites.

For a buyer, the real comparison is rarely the audit fee alone. A poorly qualified supplier costs a complaint, a recall or a supply break in the middle of the season.