Co-Packer Audit Checklist: 7 Proven Steps to Prepare Your Facility for Any Food Safety Inspection
The food safety audit landscape has fundamentally changed over the past decade. SQF, GFSI, FDA, and retailer-mandated audits have raised the bar to a level where a facility that would have passed a third-party certification review ten years ago routinely fails today. Documentation requirements are more granular, verification testing is now expected rather than optional, and auditors are trained to look beyond the binder on the shelf and examine whether systems are actually functioning on the production floor.
For food brands evaluating co-packers, and for co-packers preparing for third-party audits, the preparation gap — the distance between what a facility does and what it can prove it does — is the most common cause of audit failures. This co-packer audit checklist gives you the framework for closing that gap — and keeping it closed every production day, not just before an auditor arrives.
The stakes are real. A failed audit can trigger consequences that cascade far beyond the facility itself: losing a retail buyer relationship that took years to build, triggering a voluntary recall, or facing FDA corrective action demands — all of which cost substantially more, in both dollars and brand equity, than the investment in proper year-round preparation.
For brands that co-pack their products, a co-packer’s failed audit is their supply chain disruption. Production halts, shipments stop, and retailer shelves go empty — regardless of whether the failure originated in the brand’s operations or their co-packing partner’s facility. For brands evaluating co-packing partners, a structured co-packer audit checklist is the most reliable tool for verifying that a prospective partner’s food safety systems will protect your supply chain rather than disrupt it.
At Pack’n Fresh, we maintain continuous SQF certification, and our co-owners bring food science and quality assurance expertise to every aspect of our operations. Audit readiness is not something we activate before an auditor calls — it is how we operate every production day.
The result is a facility that performs every item on the co-packer audit checklist not on a pre-inspection schedule but as standard daily operating procedure. This guide gives you the complete co-packer audit checklist — the 7-step framework we and other leading co-packers use to stay audit-ready year-round, not just when an auditor calls. Whether you are a food brand evaluating a new co-packing partner or a co-packer preparing for your next certification audit, this checklist covers what auditors actually look for and where most facilities fall short.
Table of Contents
- Why Co-Packer Audits Are More Rigorous Than Ever — And What’s at Stake
- Understanding SQF, GFSI, BRCGS, and FSSC 22000: What Each Auditor Looks For
- The 7-Step Co-Packer Audit Checklist
- The Most Common Reasons Co-Packers Fail Food Safety Audits
- How to Conduct a Pre-Audit Internal Review
- What Happens After a Non-Conformance: Corrective Action Plans
- How Pack’n Fresh Maintains Audit-Ready Operations Year-Round
- FAQs — Co-Packer Audit Checklist
1. Why Co-Packer Audits Are More Rigorous Than Ever — And What’s at Stake
Third-party food safety certification has moved from a competitive differentiator to table stakes for co-packers serving retail, e-commerce, institutional, and food service buyers. A decade ago, many buyers would accept a co-packer’s internal quality program or a basic GMP audit. Today, the standard has shifted dramatically: major retailers and food service operators routinely require co-packers to hold a current, active certificate from a GFSI-recognized scheme — SQF, BRCGS, or FSSC 22000 — as a non-negotiable condition of vendor approval.
Without that certificate, a co-packer cannot be listed as an approved supplier regardless of how good their facility or their product actually is. Applying a co-packer audit checklist to verify current certification status before signing any production agreement is the most direct protection against this supply chain risk.
The audit cadence itself has become more demanding. GFSI-recognized schemes require annual full audits, and many schemes now include unannounced verification visits — auditors who arrive without advance notice to verify that what they saw during the scheduled audit is what actually happens every day. This shift toward unannounced verification is specifically designed to identify facilities that perform well under scheduled audit conditions but do not maintain those standards continuously.
A facility that passes a scheduled audit by doing intensive preparation in the two weeks beforehand, then relaxes its documentation and verification practices afterward, is increasingly likely to be caught in an unannounced visit. A genuine co-packer audit checklist is what distinguishes facilities that are continuously compliant from those that perform compliance only when an auditor is watching.
Layered on top of third-party certification requirements is FDA FSMA, which has added regulatory audit risk that operates independently of whether a facility holds a GFSI certificate. Under FSMA, FDA can inspect co-packing facilities on a risk-based schedule — and a facility that is not maintaining HACCP documentation, lot-level traceability, and supplier verification records consistent with FSMA requirements can face FDA warning letters, import alerts, or mandatory corrective action even if its SQF certificate is current.
For food brands evaluating co-packing partners, the critical insight is this: a co-packer’s failed audit doesn’t just affect that co-packer. Every brand whose products are made in that facility absorbs the downstream impact — supply disruption, potential recall, and in some cases loss of channel access while corrective actions are resolved. A rigorous co-packer audit checklist applied during partner evaluation directly reduces this downstream exposure before a production relationship is ever established.
2. Understanding SQF, GFSI, BRCGS, and FSSC 22000: What Each Auditor Looks For
For food brands selecting a co-packing partner and for co-packers choosing which certification scheme to pursue, understanding the differences between the major GFSI-recognized schemes matters — but so does understanding what they have in common. SQF, BRCGS, and FSSC 22000 all audit the same fundamental food safety systems: HACCP, allergen control, traceability, sanitation, personnel training, and mock recall capability.
The differences lie primarily in the structure of the audit, the documentation requirements at each level, and the regional prevalence of each scheme. All three evaluate the same seven system areas covered in the co-packer audit checklist below — which is why strong performance in one scheme transfers directly to readiness in the others.
SQF (Safe Quality Food) is the most widely recognized GFSI scheme in North America and is the scheme Pack’n Fresh is certified under. The SQF certification standard operates on a leveled system: SQF Level 2 is the standard for food manufacturers and co-packers, covering both food safety fundamentals and a quality management system. SQF Level 3 adds advanced quality systems requirements.
Most US retail buyers, particularly in the grocery and natural food channels, recognize and accept SQF certification as evidence of robust food safety management. SQF audits are conducted by licensed SQF auditors through approved certification bodies, and the resulting certificate is posted in the SQFI database — any buyer can verify a facility’s current certification status in real time. Verifying this status is item one of any co-packer audit checklist for brand due diligence — it takes under two minutes and tells you more than any co-packer’s marketing materials ever will.
BRCGS (British Retail Consortium Global Standards) is more prevalent in European supply chains and UK-connected retail buyers, though it is recognized by most US major retailers as well. FSSC 22000 integrates ISO 22000 with sector-specific prerequisite program (PRP) requirements and appeals particularly to manufacturers already operating within ISO management system frameworks. All three schemes are recognized under the GFSI umbrella, which means meeting the requirements of one scheme generally satisfies the buyer requirements for all of them.
For food brands evaluating co-packers, the most important question is not which scheme a co-packer uses, but whether their certification is current, at what level, and whether any non-conformances from the most recent audit remain open. A current certificate with zero open major non-conformances is what responsible brand managers ask to see before signing a co-packing agreement. You can learn more about GFSI food safety standards and how they apply to co-packing relationships in our dedicated guide.
3. The 7-Step Co-Packer Audit Checklist
This co-packer audit checklist reflects what GFSI-recognized auditors consistently evaluate across SQF, BRCGS, and FSSC 22000 certification reviews. Each step corresponds to a system that auditors will review through document review, records inspection, and physical facility walkthrough.
Facilities that fail audits almost always fail because one or more of these systems has a documentation gap, a verification gap, or an implementation gap — meaning the policy exists on paper but is not being followed on the production floor. Each of the seven steps in this co-packer audit checklist corresponds to one of these systems — following it systematically identifies every type of gap before an external auditor does.
Step 1 — HACCP Plan: Documentation, Validation, and Verification Records
The Hazard Analysis and Critical Control Points (HACCP) plan is the foundational document of any food safety management system, and it is always the first thing an auditor reviews. A compliant HACCP plan must identify all biological, chemical, and physical hazards associated with every product category manufactured at the facility; define each Critical Control Point (CCP) with specific, measurable critical limits; document monitoring procedures for each CCP including who monitors, how, and at what frequency; specify corrective actions for any CCP deviation; and define verification activities that confirm the overall HACCP system is working as intended. The FDA HACCP principles and application guidelines provide the regulatory framework that underpins what auditors expect to see.
What auditors specifically check extends well beyond whether the HACCP plan document exists. They verify whether the plan is dated and version-controlled — an undated HACCP plan or one that lacks a revision history raises immediate questions about whether it has been maintained. They check whether the plan was reviewed within the last 12 months and whether that review is documented with a signature and date.
They pull CCP monitoring records and verify that monitoring was actually performed at the required frequency, that the results are recorded in real time (not filled in at the end of the day), and that any CCP deviation triggered the required corrective action record. Perhaps most commonly, auditors find HACCP plans that are technically compliant on paper but are supported by monitoring records that are incomplete, have unexplained gaps, or have corrective action records that are missing for periods when monitoring data shows a deviation occurred.
The most common HACCP failure pattern is what auditors describe as a “plan-practice gap”: the written HACCP plan is detailed and well-structured, but the daily monitoring records are inconsistent, incomplete, or clearly filled in retrospectively rather than at the time of monitoring. Closing this gap requires not just having a good HACCP plan but building the record-keeping discipline into daily production workflow so that CCP monitoring records are generated in real time as a natural byproduct of production — not as a documentation exercise performed separately. HACCP documentation discipline is item one on this co-packer audit checklist and the area auditors examine first — the system most frequently found to have a plan-practice gap.
Step 2 — Allergen Control: Segregation, Scheduling, and Verification
Allergen control is among the most heavily scrutinized areas in any food safety audit and among the highest-consequence failure categories. An allergen cross-contact event — the unintended presence of an allergenic ingredient in a product that does not declare it — can trigger a Class I recall, which the FDA considers the most serious category, involving products where there is a reasonable probability that consumption will cause serious adverse health consequences or death for sensitized individuals. Auditors approach allergen control with this consequence in mind, and they look hard for gaps.
A compliant allergen control program requires several interconnected elements. First, a written allergen control policy that identifies all allergenic ingredients handled in the facility (from the FDA’s list of major food allergens, now expanded to nine). Second, a documented allergen risk assessment for every raw material received — identifying whether each ingredient contains or may contain an allergen due to shared supplier equipment or supply chain cross-contact. Third, physical segregation of allergenic ingredients in storage — clearly labeled, physically separated from non-allergenic ingredients, stored in sealed containers that prevent cross-contact during receiving and storage.
Fourth, production scheduling controls that ensure allergen-containing and allergen-free products do not share production windows without a complete, documented cleaning cycle between them. At Pack’n Fresh, siloed production scheduling is standard practice — allergen-containing product lines and allergen-free product lines are scheduled in dedicated blocks with verified cleaning separation, never interleaved in a way that creates cross-contact risk.
Fifth and critically: post-cleaning allergen verification. Auditors increasingly expect to see not just cleaning records but verification results — ATP swab test results and, where the risk assessment warrants it, ELISA allergen swab results confirming that the cleaning cycle successfully removed allergenic residues before the next production run begins. A cleaning record signed by a team member is evidence that cleaning was performed; a passing ATP or ELISA result is evidence that it was effective. The distinction matters to auditors — and to the brands whose allergen-free products are produced on shared equipment. Our dedicated guide on allergen management in food packaging covers these requirements in depth. Allergen control is the highest-consequence item on the co-packer audit checklist — and the gap between cleaning records and verified ATP/ELISA results is where auditors and brands should look hardest.
Step 3 — Traceability: Lot-Level Documentation from Receiving to Finished Product
Every GFSI-recognized certification scheme requires full, bidirectional lot-level traceability — the documented ability to identify the origin of any ingredient used in a finished product (backward traceability) and the destination of any finished product that contained a given ingredient lot (forward traceability). SQF requires that a facility can complete a full mock recall trace within four hours. For a facility producing multiple SKUs using shared ingredient lots across multiple production runs, meeting a four-hour traceability window with manual, spreadsheet-based records is extremely difficult — and auditors who have seen facilities fail mock recalls understand exactly why.
The regulatory traceability requirements have also expanded significantly with FDA’s FSMA 204 rule. The FSMA 204 traceability requirements apply to foods on the FDA’s Food Traceability List and require Key Data Elements (KDEs) to be recorded at each Critical Tracking Event (CTE) — from receiving through transformation (processing/packaging) through shipping. For co-packers handling foods on the FTL, this means the traceability documentation requirements are now defined in federal regulation, not just certification scheme guidelines.
What auditors check in the traceability system is highly specific: Is there a unique lot code on every incoming ingredient receiving record, tied to the supplier’s lot number and the date of receipt? Are production records complete — linking the specific ingredient lot codes used to the finished product lot code produced, with quantities and production date? Can the facility demonstrate a complete trace of a finished product lot back to every ingredient lot it contained, and forward from an ingredient lot to every finished product lot that used it, within the required time window?
Facilities that rely on a co-packer with ERP-backed traceability — where ingredient receiving, production, and shipping records are linked in a single system — can consistently meet four-hour traceability requirements. Facilities relying on disconnected paper records or spreadsheets routinely cannot. Traceability is step three of this co-packer audit checklist, and ERP-backed systems that link ingredient receipt to finished product dispatch in real time are the only infrastructure that consistently meets the four-hour SQF mock recall requirement.
Step 4 — Sanitation: SOPs, Frequency Records, and ATP Verification
Sanitation verification is the area where many otherwise well-prepared facilities fail — not because they do not clean their equipment and facility, but because they cannot demonstrate with quantifiable evidence that they cleaned effectively. The distinction between cleaning (the activity) and sanitation verification (the proof that cleaning achieved its intended result) is one that auditors draw carefully, and facilities that provide only the former routinely receive non-conformances.
A compliant sanitation program requires a Master Sanitation Schedule (MSS) that specifies every surface, piece of equipment, and facility area that must be cleaned, the cleaning frequency for each, the cleaning method and chemistry, and the responsibility assignment for each task. The MSS must be current — listing equipment that is actually in use — and the associated sanitation completion records must demonstrate that the schedule is being followed: dated, signed, and specific to the equipment cleaned.
Auditors pull a sample of the last several months of sanitation records and look for consistency — a schedule that shows perfect compliance every day for six months with no missed or delayed cleanings raises questions just as one with obvious gaps does.
Beyond completion records, auditors increasingly expect to see environmental monitoring results. ATP (adenosine triphosphate) swab testing provides a rapid, quantifiable measure of organic residue on a surface — a proxy for sanitation effectiveness that requires no lab and produces a result in seconds. A facility that conducts ATP swab testing after every cleaning cycle, documents the results by surface and date, has established acceptable RLU (relative light unit) thresholds, and maintains corrective action records for any out-of-spec result is demonstrating sanitation verification at the level most GFSI auditors are looking for.
At Pack’n Fresh, ATP swab testing after every cleaning cycle is standard practice — not a pre-audit preparation measure. For allergen-sensitive production lines, we supplement ATP verification with allergen swab testing at the frequency our allergen risk assessment specifies. Sanitation verification with documented ATP results is step four of the co-packer audit checklist — and the difference between facilities that can prove their cleaning worked and those that can only prove they cleaned.
Step 5 — Incoming Ingredient Inspection and Supplier Approval Program
Ingredient quality and safety begins before raw materials enter the production floor — at the receiving dock, where every incoming ingredient should be inspected against an approved specification before it is accepted into inventory. Auditors evaluate both the receiving inspection process and the upstream Supplier Approval Program that determines which suppliers are authorized to supply ingredients in the first place.
A compliant receiving inspection process requires that each incoming ingredient delivery is checked against a documented specification: weight verification, visual inspection for packaging integrity and absence of damage or contamination, temperature confirmation for any refrigerated or frozen materials, and Certificate of Analysis (COA) review against established acceptance criteria before the lot is approved for use in production. Receiving records must capture all of this: the date of receipt, the supplier, the supplier’s lot number, the quantity received, the inspection results, and the acceptance or rejection decision with the inspector’s signature.
An accepted lot that was not inspected or whose receiving record is incomplete is a gap that auditors will flag as a major non-conformance.
The Supplier Approval Program sits behind the receiving process and is equally important. Auditors expect to see a documented roster of approved suppliers for every ingredient used in production, along with the criteria used to qualify suppliers — whether through a supplier questionnaire, a supplier audit, third-party certification review, or some combination. The program should include a periodic supplier performance review process, documentation of how new suppliers are evaluated and approved before their ingredients are used in production, and a process for addressing supplier-related quality issues.
A facility that sources from unapproved or unqualified suppliers — even occasionally — is creating a supply chain risk that auditors treat as a significant system weakness, not just a paperwork gap. The Supplier Approval Program is step five of this co-packer audit checklist — it controls supply chain risk before it can reach the production floor.
Step 6 — Personnel Training Records and Food Handler Certification
All food handlers and production personnel must have documented food safety training — and the documentation requirement is not flexible. Auditors consistently apply the principle that undocumented training is treated as no training, regardless of how experienced or well-trained a facility’s workforce actually is. A facility with veteran production staff who deeply understand allergen control, GMP rules, and temperature management but whose training records are incomplete or missing will receive the same non-conformance as a facility with genuinely untrained personnel.
At a minimum, every food handler must have documented training covering: a basic food handler certification (state-issued food handler card or equivalent); facility-specific training on the allergen control program, including the allergen risk of the products produced and the employee’s role in preventing cross-contact; personal hygiene requirements, including handwashing procedures, illness reporting protocols, and prohibited items on the production floor; Good Manufacturing Practice (GMP) rules specific to the facility; and emergency contact and reporting procedures.
Auditors will ask to see training records by employee name — the ability to pull a training file for any individual on the production floor and show their complete training history, with dates and signatures, is what a compliant training program looks like.
Two specific training documentation gaps auditors find frequently: new employees who begin food handling work before their initial training is completed and documented, and temporary or seasonal workers whose training records either never existed or were not retained after their assignment ended. Both represent the same underlying system failure — training completion was not built into the pre-production authorization process as a hard requirement.
The fix is straightforward: no employee, full-time or temporary, handles food before their training checklist is completed and signed, and training records are retained for the duration required by the applicable certification scheme, typically a minimum of 12 months post-employment. Personnel training documentation is step six of the co-packer audit checklist — and one of the most consistently flagged areas in facilities with genuine training programs that simply failed to maintain the paper trail.
Step 7 — Mock Recall Readiness: Speed, Accuracy, and Corrective Action
The mock recall is the acid test of the traceability system — and it is the one exercise that most clearly reveals whether a facility’s food safety documentation functions as an integrated system or as a collection of disconnected records. SQF requires documented mock recalls to be conducted at least annually, and auditors review mock recall records as part of every certification audit.
Increasingly, leading co-packers conduct mock recalls on a semi-annual or quarterly basis, recognizing that a once-per-year exercise is insufficient to keep the recall response muscle sharp and to identify traceability gaps before an actual recall event forces them to surface.
A compliant mock recall must test both directions of traceability. A forward trace starts with a specific incoming ingredient lot code and requires the facility to identify every finished product lot that contained that ingredient and every customer who received those finished product lots — the scenario that mirrors an actual ingredient recall notification from a supplier. A backward trace starts with a finished product lot code and requires the facility to identify every ingredient lot that went into that product — the scenario that mirrors an actual customer complaint or FDA inquiry about a specific production lot. Both directions should be tested, documented, and timed.
Auditors reviewing mock recall records evaluate four things: Did the mock recall test the right scenarios (both forward and backward traceability)? Was it completed within the required time window (four hours under SQF)? Was the result accurate — did the facility identify all affected lots, with no product unaccounted for? And were any gaps or failures identified during the mock recall addressed through documented corrective actions?
A mock recall that completes within four hours with a 100% accuracy rate and no corrective actions needed is strong evidence of a functioning traceability system. A mock recall that took six hours, missed two finished product lots, and has no corrective action record is strong evidence that the traceability system needs significant remediation — which is exactly why finding this in an internal mock recall, rather than in a real recall event, is the point of the exercise. This complete co-packer audit checklist is designed to surface those gaps before an auditor or a real event does.
4. The Most Common Reasons Co-Packers Fail Food Safety Audits
After years of operating under continuous SQF certification and watching the food safety audit landscape evolve, the patterns behind audit failures are consistent and largely preventable. Facilities that fail GFSI audits rarely fail because they lack food safety knowledge or because their production environment is genuinely unsafe. They fail because one or more critical systems has a documentation gap, a verification gap, or a gap between written policy and actual practice — and those gaps are exposed under the systematic scrutiny of a trained third-party auditor.
The most frequently cited reasons for audit non-conformances, across SQF, BRCGS, and similar schemes, fall into recognizable categories. Incomplete HACCP monitoring records — CCP monitoring forms with unexplained blank periods, corrective action fields left empty when monitoring data shows a deviation, or records that appear to have been completed retrospectively rather than in real time. Allergen cleaning records without supporting verification test results — facilities that can show a cleaning was performed but cannot show that it was effective through ATP or ELISA swab data.
Traceability gaps — ingredient receiving records that capture supplier name but not lot code, or production records that link finished product to a blend batch but not to the specific incoming ingredient lots that made up that blend — are another frequently cited failure area.
Sanitation records that are signed but not dated, or signed by personnel who were not present during the cleaning, represent another persistent failure category. Training records for seasonal, temporary, or contract workers that were never created, or were not retained after the worker’s assignment ended, consistently generate non-conformances. HACCP plans that have not been formally reviewed within the last 12 months — even if the underlying hazard analysis is still accurate — fail on documentation grounds.
And failed mock recalls, where a facility cannot complete a full bidirectional trace within the four-hour SQF requirement, expose the fundamental weakness of manual, disconnected traceability systems. Every one of these is a preventable failure — the root cause in each case is a system that is not consistently maintained, not a facility that is fundamentally incapable of compliance. The co-packer audit checklist in this guide is specifically designed to surface each of these documented failure patterns during an internal review — before an external auditor identifies them during a scheduled or unannounced certification visit.
5. How to Conduct a Pre-Audit Internal Review
The most effective preparation for a third-party food safety audit is a rigorous internal audit conducted using the same evaluation framework the certifying body will use. SQF publishes its audit question sets through its certification body network, and BRCGS makes its audit checklist available through its licensing structure. Requesting or accessing the current audit question set for your certification scheme and using it as the basis for your internal review is the single most direct way to identify gaps before an external auditor does.
A thorough internal audit should physically walk every area that the external auditor will access: the receiving dock (reviewing recent receiving records and the physical organization of incoming ingredient storage); the ingredient storage area (checking label integrity, allergen segregation, FIFO rotation, and lot code visibility); the production floor (reviewing CCP monitoring records against the HACCP plan, checking that equipment is in the state described in sanitation records, and verifying that production scheduling aligns with the allergen control program).
The walkthrough should also cover the packaging lines (checking label accuracy, finished product lot coding, and rework handling procedures); the finished goods storage and shipping dock (verifying lot code integrity on outbound shipments and reviewing shipping records); sanitation storage (confirming that chemicals are properly labeled, stored separately from food contact areas, and that the SDS binder is current); and employee hygiene areas (checking that handwashing stations are stocked and accessible and that posted GMP requirements are current).
Beyond the facility walkthrough, pull traceability records for three to five recent production lots and walk through a complete mock trace — both forward from an ingredient lot and backward from a finished product lot — while timing the exercise. If you cannot complete it in under four hours using your current records and systems, that gap must be closed before your audit date.
Review the last 12 months of CAPA (corrective action and preventive action) records: auditors will ask what changed in your operations as a result of your last non-conformances, and a CAPA record that shows a documented root cause analysis, a specific corrective action taken, and evidence of effectiveness monitoring is what they want to see.
Assign a single pre-audit owner — a specific person who is accountable for documenting every gap identified in the internal review, assigning a responsible party and target closure date for each, and tracking closure before the external audit date. Pre-audit preparation that produces a punch list without an owner and a timeline rarely results in all gaps being closed. The co-packer audit checklist framework — covering HACCP, allergen, traceability, sanitation, receiving, training, and mock recall — gives the pre-audit owner a structured punch list that covers every system an external auditor will assess.
6. What Happens After a Non-Conformance: Corrective Action Plans
Receiving a non-conformance during a food safety audit is not unusual — most audits, including audits of well-run facilities, produce at least some findings. What matters is how non-conformances are classified, how the facility responds, and whether the corrective action plan demonstrates genuine root cause resolution or superficial remediation. Auditors are experienced at distinguishing between a substantive corrective action and a paper response designed to close a finding without actually fixing the underlying system.
Non-conformances under GFSI schemes are typically classified into three categories. Critical non-conformances involve an immediate, direct threat to food safety — conditions where product may have been or could be adulterated, mislabeled, or otherwise unsafe. A critical non-conformance can result in immediate certification suspension, and depending on the scheme, may require the facility to halt production of affected products until the condition is remediated and verified.
Major non-conformances represent significant gaps in the food safety management system — a broken system rather than an isolated documentation lapse. Major findings typically require a corrective action plan submitted within 28 days, with closure verified either through documentary evidence or a follow-up visit. Minor non-conformances represent isolated documentation gaps or process deviations that do not indicate a systemic failure — typically closed through documentary evidence within 28 to 60 days.
The quality of a corrective action plan (CAP) determines whether a non-conformance closes. Auditors review CAPs for three elements: root cause analysis (what actually caused this gap, not just what the gap was), corrective action taken (what specific change was made to address the root cause — not just “retrained staff,” which is a surface-level response that rarely addresses root cause), and effectiveness verification (how the facility will confirm that the corrective action worked, and over what time horizon).
A CAP that states “employees were retrained on the allergen control procedure” without identifying why the allergen control procedure was not being followed in the first place, and without specifying how compliance will be monitored going forward, will typically be rejected by the certification body as insufficient. The investment in a substantive CAP process — one that actually identifies and fixes the root cause — is also the investment that prevents the same finding from recurring in the next audit cycle. Understanding corrective action requirements is a critical component of the co-packer audit checklist framework — both for co-packers managing their own compliance posture and for brands evaluating whether a prospective partner’s response to past findings reflects genuine system improvement.
7. How Pack’n Fresh Maintains Audit-Ready Operations Year-Round
At Pack’n Fresh, audit readiness is not a mode we enter when we receive an audit notification — it is the operational standard we maintain every production day. This distinction matters for the food brands that co-pack with us: when your co-packer’s food safety systems are functioning continuously at audit-ready standards, your supply chain does not carry the risk of an audit failure disrupting production or triggering a recall. Here is how we maintain that standard.
Our ERP system maintains lot-level traceability from the moment an ingredient is received through every stage of production and into finished product shipping records. Every incoming ingredient receiving record captures the supplier, the supplier’s lot code, the quantity received, the inspection result, and the date — linked automatically to the production records for any batch that uses that ingredient. Production records link every ingredient lot code to the finished product lot code and batch quantity. Shipping records link finished product lot codes to specific customer orders and shipment dates.
The result is a fully connected traceability chain that allows us to complete a bidirectional mock recall trace in well under the SQF four-hour requirement — without the manual effort of reconciling disconnected paper records.
Our Digital Ingredient Locking system adds an additional layer of allergen protection that goes beyond scheduling controls. Before each production run, the system verifies that the ingredient lots scanned for use match the approved formulation for the product being produced. If an incorrect ingredient — including an allergen-containing ingredient not specified in the formula — is scanned for a production run, the system halts and requires resolution before production can proceed. This prevents allergen cross-contact at the source, before product is made, rather than relying solely on post-production verification to catch errors.
Combined with siloed production scheduling that dedicates separate production windows to allergen-containing and allergen-free products, and ATP swab verification after every cleaning cycle before production resumes, our allergen control system operates with multiple independent verification layers. Our co-owners’ food science and quality assurance backgrounds are embedded in how every one of these systems was designed — audit readiness is a reflection of how we believe food safety operations should be run, every day, not just when an auditor is present. Every element of the co-packer audit checklist — HACCP documentation, allergen verification, traceability speed, sanitation evidence, personnel records — is a daily operating standard at Pack’n Fresh, not a pre-inspection preparation mode.
Conclusion: Audit Readiness Is an Operational Discipline, Not a Preparation Event
The co-packer audit checklist in this guide — seven steps covering HACCP documentation, allergen control, lot-level traceability, sanitation verification, incoming ingredient inspection, personnel training, and mock recall readiness — represents the baseline that GFSI auditors expect to find in any certified co-packing facility. None of these seven systems is technically complicated. All of them require consistent, disciplined execution and documentation every production day, not just in the weeks before an audit.
The facilities that consistently pass audits — and that pass unannounced verification visits — are those that have built audit-ready operations into their daily workflow, not those that have the most intensive pre-audit preparation process.
For food brands evaluating co-packing partners, this checklist is also a due diligence framework. Ask prospective co-packers to walk you through their HACCP plan and their last mock recall results. Ask to see their current SQF or BRCGS certificate and whether any major non-conformances from the last audit are still open. Ask how they manage allergen scheduling and what verification testing they conduct between allergen-containing and allergen-free production runs. Ask how their traceability system works and how quickly they could complete a full trace in a real recall scenario.
The answers — and the ease and specificity with which a co-packer answers them — tell you a great deal about whether audit readiness is embedded in their operations or performed for the purposes of certification. This line of inquiry is an informal co-packer audit checklist in practice — and a co-packer who cannot answer these questions with specificity and confidence has already answered the most important one.
At Pack’n Fresh, we maintain SQF certification continuously because we believe it reflects how food safety operations should be run — not as a credential, but as a discipline. If you are a food brand looking for a co-packing partner whose food safety systems protect your brand, your customers, and your supply chain, we welcome the conversation. Request a quote or reach out through our contact page to discuss your product and co-packing needs. If you would like to evaluate Pack’n Fresh against the co-packer audit checklist in this guide, a facility review is the fastest and most reliable way to get that answer.
FAQs — Co-Packer Audit Checklist
How often do co-packers need to be audited under SQF certification?
SQF-certified co-packers are required to undergo a full third-party certification audit at least once per calendar year. In addition, SQF Level 2 and Level 3 certified facilities may be subject to unannounced verification visits conducted between scheduled audits. These unannounced visits are designed to verify that the food safety practices observed during the scheduled audit represent the facility’s normal daily operations — not a heightened pre-audit performance.
Some certification bodies conduct unannounced visits on a risk-based frequency, targeting facilities that received non-conformances in their most recent scheduled audit or that operate in higher-risk product categories. For brands using a co-packer audit checklist to evaluate prospective partners, auditing cadence and unannounced visit history are important qualification data points alongside current certification status.
What is the difference between an SQF audit and an FDA inspection?
An SQF audit is a voluntary third-party certification assessment conducted by a licensed SQF auditor on behalf of a certification body. Its purpose is to verify that a facility meets the SQF code requirements, and the result is a certification that a facility can present to buyers as evidence of its food safety management system. An FDA inspection is a government regulatory inspection conducted by FDA-commissioned inspectors under the authority of federal food safety law, including FSMA.
FDA inspections can be routine (scheduled on a risk-based frequency) or for-cause (triggered by a complaint, outbreak investigation, or import alert). Failing an SQF audit may result in loss of certification; an FDA inspection that identifies significant violations can result in warning letters, consent decrees, product seizures, or mandatory facility closure. A facility can hold a current SQF certificate and still receive FDA findings if its practices do not meet FSMA regulatory requirements — the two systems are complementary but independent. This distinction matters when using a co-packer audit checklist for vendor evaluation — a current SQF certificate does not guarantee FDA FSMA compliance, and brands should verify both independently.
How long does it take to become SQF certified for the first time?
The timeline for initial SQF certification varies based on a facility’s starting point, but most facilities that undertake a serious gap assessment and remediation process are audit-ready within six to twelve months. The process involves conducting a gap assessment against the SQF code, developing or updating the HACCP plan and prerequisite programs, implementing required documentation and record-keeping systems, training all relevant personnel, conducting internal audits, and completing at least one mock recall exercise before scheduling the certification audit.
Facilities that have strong foundational food safety practices — existing HACCP plans, active sanitation programs, and some form of traceability documentation — typically move through the process faster than facilities building food safety systems from scratch. Engaging a qualified SQF consultant or working with an experienced co-packer who holds current SQF certification can significantly accelerate the readiness timeline. Brands applying a co-packer audit checklist to evaluate a prospective partner’s first-time certification readiness should factor this timeline into their production launch planning to avoid supply chain gaps during the certification process.
What should a food brand ask to see before choosing a co-packer to verify food safety?
Before signing a co-packing agreement, food brands should request several specific items to verify a co-packer’s food safety posture. First, the co-packer’s current third-party food safety certificate — SQF, BRCGS, or FSSC 22000 — and confirmation that it is active with no suspended status. Second, a summary of the most recent audit’s non-conformances and the corrective action plans for any open findings. Third, a description of the facility’s allergen control program, including how allergen scheduling works and what verification testing is conducted between allergen-containing and allergen-free production runs.
Fourth, a demonstration or description of the traceability system — specifically, how quickly a full mock recall trace can be completed and what records are used. Fifth, the facility’s food safety certifications and regulatory compliance history, including whether any FDA warning letters or Form 483 observations have been issued in the past three years. A co-packer who is confident in their food safety systems will provide this information readily; significant reluctance or inability to produce it is informative in its own right. This five-question sequence is effectively an applied co-packer audit checklist for brand due diligence — one that can be deployed in any vendor evaluation conversation without conducting a formal facility audit.
Can a co-packer lose their SQF certification after a failed audit?
Yes. A co-packer can have their SQF certification suspended or withdrawn following a failed audit, depending on the severity and nature of the non-conformances identified. A single critical non-conformance — one that involves an immediate threat to food safety — can trigger certification suspension even if the facility has held certification for many years. Multiple major non-conformances that are not remediated within the required timeframe, or a pattern of recurring major non-conformances across audit cycles, can result in certificate withdrawal.
When a certificate is suspended, the facility cannot represent itself as SQF-certified, and any buyers requiring active SQF certification as a vendor approval condition may suspend the co-packing relationship. Certification suspension is publicly visible in the SQFI database, which means buyers can verify a facility’s status in real time. This is why continuous, year-round audit readiness — not periodic pre-audit preparation — is the only reliable approach to protecting certification status. Year-round execution against the co-packer audit checklist framework is what actually sustains certification across audit cycles — not the intensity of the sprint that happens before the auditor arrives.
Does Pack’n Fresh allow client-initiated audits of their facility?
Yes. Pack’n Fresh welcomes client-initiated facility reviews and audits as part of our commitment to transparency and partnership with the brands we co-pack for. We understand that food brands have a direct responsibility to their customers for the safety and quality of the products bearing their labels — and that a thoughtful brand will want to verify that their co-packing partner’s food safety practices meet their own standards, not just certification body standards.
During a client facility review, we can walk you through our HACCP documentation, our allergen control program and production scheduling practices, our lot-level traceability system, our sanitation records and ATP verification results, and our mock recall process. If you are evaluating Pack’n Fresh as a co-packing partner and want to conduct a facility review as part of your due diligence, we encourage you to reach out through our contact page to schedule a visit. A client facility review is the most direct application of a co-packer audit checklist — it evaluates the seven systems covered in this guide in real time against what you observe on the production floor.