Regulations and Standards in Food Supply Chain Audits

Ask a supplier which rules apply to its plant and you may hear three different answers from three different managers, each partly right. Food law, customer standards, certification schemes, and your own specification all apply at once, but they do different jobs. Confusing them leads to audits that miss legal duties or treat a private standard as if it were law.

Sorting out that hierarchy helps you audit with precision. Law sets the floor below which no business may fall. Certification schemes build management systems above that floor. Buyer requirements add product-specific controls. Your audit should test each layer for what it is.

Law as the foundation

National and regional law governs matters such as adulteration, labelling, allergen declaration, permitted additives, hygiene, traceability, and recall duties. Rules differ by market, so a product legal in one country may be mislabelled or non-compliant in another. Suppliers selling across borders need a reliable way to track destination requirements.

In the United States, the Federal Food, Drug, and Cosmetic Act prohibits adulterated and misbranded food in interstate commerce. Food Safety Modernization Act rules add preventive duties. Current Good Manufacturing Practice and preventive controls for human food sit in 21 CFR Part 117. Subpart B covers cGMP, Subpart C covers hazard analysis and risk-based preventive controls, and Subpart G covers a risk-based supply-chain program for certain supplier-controlled hazards.

Produce, seafood, juice, low-acid canned foods, dietary supplements, and animal food have their own specific rules in other parts of Title 21. A competent audit checks which parts actually apply to the supplier’s products and processes, rather than applying a generic legal list.

Import rules and buyer responsibility

Importing changes who answers to the regulator. Under the Foreign Supplier Verification Programs rule, 21 CFR Part 1 Subpart L, the US importer must perform risk-based foreign supplier verification. Duties include hazard analysis, evaluating foreign supplier performance and food risk, approving suppliers, determining appropriate verification activities, conducting those activities, taking corrective actions, and keeping records. Verification can include audits, sampling and testing, or review of records, chosen according to risk.

Traceability duties are expanding as well. FDA’s Food Traceability Rule, 21 CFR Part 1 Subpart S, applies to foods on the Food Traceability List and requires key data elements at critical tracking events for covered foods. Even where a supplier is outside direct scope, buyers may need data from that supplier to meet their own duties.

Other major regulatory systems

European Union food law rests on general principles in Regulation (EC) No 178/2002, with hygiene rules in Regulations (EC) No 852/2004 and 853/2004 for products of animal origin. Canada operates under the Safe Food for Canadians Act and its regulations, with licensing and preventive control plans for many food businesses. Codex Alimentarius texts, developed by the Codex Alimentarius Commission, guide many national systems and trade expectations, though Codex itself is not a direct regulator of your supplier.

Private standards and certification schemes

Certification schemes turn good practice into auditable management requirements. GFSI, the Global Food Safety Initiative, does not certify sites itself. It benchmarks certification programme owners against its requirements, and recognition means a scheme meets that benchmark. Widely used GFSI-benchmarked programmes for food manufacturing include BRCGS Global Standard Food Safety, SQF Food Safety Code, FSSC 22000, and IFS Food, among others.

Schemes typically require a food safety management system, hazard analysis based on HACCP principles, prerequisite programmes, internal audits, corrective action, management review, and traceability testing. Audits are carried out by certification bodies, usually accredited, using auditors who meet scheme competence rules. That structure differs from your own second-party audit, where you set the criteria and decide the outcome for your supply relationship.

Never treat a certificate as a legal verdict. A certified site can still break the law, and an uncertified small supplier might operate legally and well. Use certification as evidence within your approval decision, after checking scope, site address, expiry, and audit outcome details you are entitled to review.

Customer and company requirements

Above law and scheme requirements sit buyer-specific rules: approved allergen lists, raw material specifications, foreign-body detection standards, packaging requirements, sustainability or animal welfare commitments, and notification duties for process changes. Such rules bind by contract, not by statute, but breach can still end supply and damage trust.

Conflicts occasionally appear. A customer may demand a test or limit stricter than law, or a labelling format that another market forbids. Raise conflicts early, document the agreed resolution, and never instruct a supplier to break law to satisfy a commercial preference.

Auditing against the right criteria

Prepare an audit criteria map before you assess a supplier. List each requirement source, its owner, and how you will verify it. Cite the exact standard clause or regulation in findings where you can. Vague findings such as “system not compliant” help nobody fix anything.

Stay current. Regulations amend, schemes issue new versions, and transition periods matter. Build a review habit: regulatory alerts, scheme updates, and customer bulletins feed into checklist revision, with old versions retired so auditors do not grade against dead rules.

Key points

• Law sets a mandatory floor; certification schemes and buyer rules build above it for different purposes.
• In the US, 21 CFR 117 covers cGMP, preventive controls, and in Subpart G, supply-chain programmes.
• FSVP under 21 CFR Part 1 Subpart L makes US importers responsible for risk-based verification of foreign suppliers.
• GFSI benchmarks schemes such as BRCGS, SQF, FSSC 22000, and IFS; GFSI itself does not certify sites.
• Check certificate scope, site, and expiry, and never treat certification as proof of legal compliance.
• Map audit criteria to their source and keep checklists updated as rules and scheme versions change.