Supplier Audit in Morocco and Africa: A Guide for EU and UK Buyers

What is a supplier audit, and how does it differ from certification?

It is a second-party audit: a buyer, an importer or a group appoints an auditor at its supplier to check that the supplier can deliver, consistently, the product described in the buyer’s specification. It issues no certificate. It ends with an approval recommendation, and the listing decision stays with the buyer.

The difference from certification comes down to three things: who commissions the audit, which checklist it follows and which decision it serves. A certification audit is commissioned by the site, carried out by an independent body under the standard owner’s rules, and leads to a certificate the whole market can read. A supplier audit is commissioned by a customer, follows that customer’s checklist and serves a single decision: whether to buy, and on what terms. The roles of the consultant, the second-party auditor and the certification body are set out on our audits and inspections page.

For a buyer sourcing from Morocco, the consequence is practical. The BRCGS, IFS or FSSC 22000 certificate opens the door; your audit checks that your product, your recipe, your label and your brand are under control behind that door.

Why do European and UK buyers audit their suppliers?

Because they answer for what they sell, and they must be able to prove it. Three logics overlap.

Legal responsibility. In the EU, the General Food Law, Regulation (EC) No 178/2002, covers all stages of the production and distribution of food and feed. Its Article 17 requires food business operators to ensure, at all stages under their control, that food satisfies the requirements of food law, and to verify that it does; Article 18 requires them to identify their suppliers and the businesses they supply; Article 19 requires them to start withdrawing immediately any food they have reason to believe does not meet the food safety requirements, and to inform the competent authorities. In Great Britain, section 21 of the Food Safety Act 1990 provides a due diligence defence: the person charged must prove that they “took all reasonable precautions and exercised all due diligence” to avoid committing the offence. For a person charged under section 14 or 15 who neither prepared the food nor imported it into Great Britain, the Act looks in particular at whether they carried out all such checks of the food as were reasonable in all the circumstances, or whether it was reasonable to rely on checks carried out by the person who supplied the food to them. A documented supplier audit programme is part of those precautions.

The buyer’s own certification. A certified importer or manufacturer must approve its suppliers. BRCGS Food Safety Issue 9 allows three routes (clause 3.5.1.2): certification to BRCGS or to a GFSI-recognised standard whose scope covers the materials purchased, a supplier audit, or a questionnaire reserved for suppliers assessed as low risk, with a justification. The supplier audit is therefore often a requirement of the buyer’s own standard, not just a commercial precaution.

The law of the country of sale. The FSSC 22000 Version 7 scheme requires finished products to be labelled according to the legal requirements of the intended country of sale, allergens included. A Moroccan supplier exporting to France, Germany and the United Kingdom applies three sets of labelling rules; the buyer wants to see how it manages them.

Which standards does a supplier audit in Morocco and Africa rely on?

No single standard. The checklist layers the buyer’s specification, the recognised standard that matches the supplier’s activity, and the regulations of Morocco and of the country of sale. In Morocco, the starting point is the approval or sanitary authorisation issued by ONSSA, the national food safety authority (Office national de sécurité sanitaire des produits alimentaires). The table gives the starting point by type of supplier.

Four points often change the scoping:

• GFSI-recognised does not mean accepted by the buyer. The GFSI page lists twelve recognised programme owners, but the buyer may name a specific standard, version or edition. Our GFSI standards page compares all twelve.
• Entry programmes are not GFSI standards. START! and IFS Progress help a site make progress; IFS Progress is an assessment, not a certificate. A buyer that accepts them says so in writing and adds an audit.
• Fresh produce has its own rules. GLOBALG.A.P. presents the GFS edition as designed for GFSI recognition, and the GRASP social add-on as voluntary unless the buyer requires it. The details are on our GLOBALG.A.P., SQF and PrimusGFS page.
• Audit method has its own standard. ISO 19011:2026, the guidelines for auditing management systems, is the common reference for managing a programme, conducting audits and evaluating auditors, second-party audits included. ISO 19011:2026 was published on 27 May 2026 (4th edition) and replaces the 2018 edition, according to the ISO committee page.

What does the auditor check that the certificate does not cover?

What belongs to the contract and to the country of sale, which the certification body has no mandate to judge. Scope, subcontracting, recipe and labelling are listed on our audits and inspections page. At a Moroccan or African supplier, six topics almost always come on top.

The exact regulatory status. Does the ONSSA approval or sanitary authorisation number cover the address, the activity and the premises that make your product? For fishery products exported to the EU, the establishment must appear on the list proposed by the competent authority of the exporting country and kept by the Commission in TRACES. A new line or an added storage unit is checked on both sides.

Residues and contaminants. The European Commission sets maximum residue levels for pesticides for all food and feed. The auditor checks that the supplier’s testing plan targets the limits of the destination country, not those of another market, and that the laboratories are competent: for tests that verify a critical parameter, FSSC 22000 Version 7 refers to the applicable requirements of ISO/IEC 17025.

Claims. Origin, free-from allergen, production method: for a claim, FSSC 22000 Version 7 requires validation evidence and verification through traceability and mass balance. A buyer printing a claim on its own brand asks for the same level of evidence, whatever the supplier’s standard.

Packaging. Since 12 August 2026, food-contact packaging placed on the EU market must meet the PFAS limits of Regulation (EU) 2025/40. The manufacturer under the PPWR draws up its declaration of conformity from information supplied by its own suppliers. The audit checks that the supplier knows where its packaging comes from and what it can prove: see our PPWR and packaging page.

Fraud and authenticity. Olive oil, spices, honey, seafood: high-value materials call for a food fraud vulnerability assessment, which GFSI-recognised standards require. The auditor reads it against the site’s actual purchases.

Seasons and seasonal workers. A packhouse or a cannery that doubles its headcount at peak season cannot be judged out of season. The audit is timed for a period when the buyer’s product is in production, with the teams that make it.

Which audit format fits the decision you have to make?

The format follows the question. An initial approval audit, a renewal audit and an audit triggered by a complaint are neither prepared nor conducted the same way. The standard sequence, from scoping to action follow-up, is on our audits and inspections page; the table helps you choose the format.

Two rules prevent most disappointments. First, the first approval of a high-risk supplier is done on site: even in certification, BRCGS reserves the blended audit, partly remote, for recertifications. Second, the format is written into the purchasing contract, unannounced audits included: an audit right that the contract does not provide for gets negotiated on the day of the visit, usually badly.

To prepare the audited site, share our guide on how to prepare a factory for a buyer’s supplier audit. To size a full programme, read what drives the cost and duration of a supplier audit programme.

Which deliverables should the buyer require?

A recommendation you can defend, and the evidence behind it. A report that describes the site without concluding does not serve the buyer; a conclusion without evidence will not survive an incident. The structure of our reports, common to all our audits, is on the audits and inspections page. For a supplier audit, the conclusion takes one of three forms, defined at scoping with the buyer:

1. Approved: no finding stands in the way of deliveries; minor findings follow their action plan.
2. Approved with conditions: deliveries are possible if written conditions are met, for example stepped-up checks at goods-in, a restricted scope or evidence due by a fixed date.
3. Not approved at this stage: a serious finding prevents deliveries; a follow-up audit or new evidence is needed.

The severity of each finding follows the agreed scale, for example critical, major or minor, and each finding cites the requirement, the evidence observed and the action expected.

Before signing the assignment, check that the proposal includes these deliverables:

• A one-page summary for the purchasing director, with the recommendation and its conditions.
  
• A written comparison between the certificate scope and the products, lines and addresses you buy from.
  
• Findings graded on the agreed scale, each with the requirement, the evidence and the action expected.
  
• The timed result of the traceability exercise on a batch of your product, with the mass balance.
  
• The list of documents and records reviewed, and of the people interviewed.
  
• Photos taken with the site’s consent, linked to the findings.
  
• The supplier’s action plan, the verification of its evidence and the closure date of each finding.
  
• A report in the buyer’s language, even if the audit was conducted in French or Arabic.
  
• The confidentiality rule and the list of report recipients.
  

For a programme covering several suppliers, reports, findings and action status are available supplier by supplier in your Inspirra client space.

Who should audit your suppliers: what competence, what impartiality?

An auditor who knows the supplier’s standard, the trade being audited and the regulations of both countries, and who has no stake in the outcome. Competence is checked on paper; impartiality is declared in writing.

On competence, ask four questions. Does the auditor hold a recognised auditor qualification, Lead Auditor for example? Do they know the standard the supplier holds, so as not to repeat the certification audit and to target what it does not cover? Have they audited this trade: cannery, packhouse or packaging? Do they speak the operators’ language, so they can hear them without an intermediary?

On impartiality, the rule is simple. The auditor signs a declaration of no conflict of interest with the audited site. ACG advises and audits, but never certifies a site it has advised: that is the impartiality principle on which certification rests, and we apply it to our audits too.

ACG’s founder, Dr. Ismail Idrissi, is an IRCA-certified QHSE Lead Auditor and an IFS Food and BRCGS auditor. He audits as a third party for Eurofins and URS in Morocco, West Africa and the MENA region, and he is the only BRCGS-registered consultant in Africa, according to the BRCGS list of consultants. That certification auditor’s eye lets us read a certification body’s report, see what it does not cover and target the visit.

Before appointing an auditor, tick these points:

• Their auditor qualification and their experience of the trade audited are documented.
  
• They know the standard held by the supplier and its current version.
  
• They speak the language of the site’s teams, or interpretation is arranged.
  
• They have signed a declaration of no conflict of interest with the supplier.
  
• The checklist, the tests and the form of the recommendation are agreed in writing.
  

A typical case shows what is at stake. An EU-based importer approves three Moroccan suppliers of canned fish and fresh produce: three valid certificates, three gaps that only the document review and the on-site audits revealed. The full typical case details the approach, and our news article on buyer requirements in 2026–2027 explains why these audits are tightening.