Supplier Qualification in Morocco: An EU Importer Case Study

What did the importer ask for?

To approve three Moroccan suppliers before the next season, and to be able to prove it to its own customers. This is a typical case: it brings together situations met in supplier audits, without describing a real client or a real supplier.

The importer is established in the EU. It distributes canned fish and fresh vegetables to European retailers; part of the canned sardines is resold to a UK retailer. The importer is itself certified and must approve its suppliers based on risk. Three sites are involved:

• Supplier A, a sardine cannery in the Safi area, on Morocco’s Atlantic coast, certified to BRCGS Food Safety Issue 9, which sells under its own brand;
• Supplier B, a cannery in the Agadir area, certified to IFS Food Version 8, which would make mackerel fillets under the importer’s brand;
• Supplier C, a cherry tomato packhouse in the Souss-Massa region, around Agadir, certified to GLOBALG.A.P. IFA v6, working with a group of growers.

The question put to the auditor was written down at scoping: can each supplier deliver, consistently, the product in the specification, in line with the law of the countries of sale?

How was the audit programme built?

From the risk of each product, with a document review before any visit and audits timed to the production seasons. The table summarises the scoping the importer approved.

The document review covered the certificates, checked in the BRCGS Directory and the IFS Database, the approvals issued by ONSSA, Morocco’s national food safety authority, the specifications, the HACCP plans and the latest test results. For A and B, it checked that each establishment was listed on the EU list published in TRACES: according to the Commission’s Access2Markets FAQ, the country must be authorised, the plant must obtain its own approval and labelling follows specific rules.

What did the three audits reveal?

One major gap per site, each of a different kind, and none of them visible on the certificate.

Supplier A: histamine is decided before the plant

The BRCGS system was solid inside the walls: validated sterilisation schedules, seam checks per seaming head, histamine sampling on the finished product. The audit went upstream. For part of the fish intake, no temperature was recorded between landing and receipt; acceptance criteria relied on the vessels’ declarations. Yet histamine forms when the cold chain is not maintained between landing and canning: the auditor expects control upstream, not just a check on the finished product.

The traceability exercise on a batch for the importer linked the finished product to the fish and the oil, but not, within the time set by the site’s own procedure, to the batch of lids. For UK shipments, the cannery knew the requirements published on GOV.UK: sardines and mackerel belong to the fish families that can form histamine, classed as medium risk, and travel with a health certificate.

Supplier B: two brands on the same line

The IFS Food Version 8 certificate did cover canned fish. The audit was scheduled on a changeover day, between the site’s own brand and the importer’s. Cartons from the previous run were still at the packing station after a line clearance recorded as done. The latest change to the importer’s artwork had been printed without its written approval.

The specification included an origin claim. The mass balance for one batch could not be closed: a product rework had not been recorded. A claim without a closed mass balance cannot be defended in front of a retailer.

Supplier C: the right certification, the wrong edition

The document review had already found the main gap. The packhouse held a GLOBALG.A.P. IFA v6 certificate in the Smart edition; the importer’s retail customer required the GFS edition, which the GLOBALG.A.P. IFA page presents as designed for producers who need GFSI recognition. The same retailer asked for the GRASP social assessment, carried out every year alongside the IFA audit, by the same certification body, which issues a letter of conformance valid for one year.

On site, two further findings. The residue testing plan had been built for another market, whereas the European Commission sets maximum residue levels for all food, and its database makes them searchable, with only the Official Journal being authentic. And some of the seasonal workers recruited at the start of the season had no record of hygiene training.

What decisions did the importer take?

Three different recommendations, each with written conditions. The listing decision remained the importer’s.

Follow-up was adapted to the nature of the evidence. For A, the evidence was documentary: temperature records, the revised procedure, the result of the new exercise. For B, the failure concerned a practice: only a new visit could verify it. Reports, findings and action status were tracked supplier by supplier in the Inspirra client space.

What did the PPWR change in these three files?

One question per supplier: who is the manufacturer of the packaging under Regulation (EU) 2025/40, applicable since 12 August 2026? According to the Commission’s FAQ, there is only one manufacturer per packaging item, and it draws up the EU declaration of conformity from information supplied by its suppliers. Applied to the typical case, a reading to be confirmed in writing with each party:

• A sells under its own brand: the cannery is in principle the manufacturer of the sales packaging, even though it is established outside the EU, and carries the declaration of conformity, directly or through an authorised representative.
• B manufactures under the importer’s brand: the brand owner is in principle the manufacturer; B passes on the information on its cans, its cartons and their suppliers.
• C ships in cartons without a customer brand: the manufacturer of this transport packaging is in principle the carton maker; C asks it for the relevant information.

For food-contact packaging, the PFAS limits have applied since 12 August 2026. The detail of the roles is on our PPWR and packaging page.

What lessons for a buyer approving Moroccan suppliers?

Three valid certificates were not enough, and three different gaps showed why. Before your next programme, check these points:

• The written scoping sets one decision question per supplier, and the form of the recommendation.
  
• Each certificate is checked in the official database: version, edition, scope, address.
  
• The EU listing and the ONSSA approval cover the actual establishment and activity.
  
• Your end customers’ requirements, GLOBALG.A.P. edition and GRASP included, are in the specification.
  
• A contract manufacturer is audited on a changeover day between your brand and another one.
  
• The traceability exercise covers your batch, packaging included, with a closed mass balance.
  
• The supplier’s testing plan targets the limits of the country of sale.
  
• The PPWR manufacturer of each packaging item is identified in writing.
  
• Follow-up is matched to the evidence: remote if it is documentary, on site if it concerns a practice.
  

For the full method, read our guide to supplier audits in Morocco; to size a programme, see what drives the cost and duration of supplier audits. The requirements specific to canneries are detailed on our seafood and canning page, and those for packhouses on our GLOBALG.A.P., SQF and PrimusGFS page.