Third-Party Food Safety Audits: How They Work and How to Choose an Audit Company

A food safety audit is a systematic, independent and documented check of whether a food business meets written food safety criteria, such as a certification standard, a customer's requirements or its own procedures. It can be first-party (internal), second-party (by or for a customer) or third-party (by an independent organization, usually an accredited certification body).

A third-party food safety audit is an assessment of a food site against a published standard by an organization independent of both the site and its customers, usually an accredited certification body. Many are certification audits to GFSI-recognized programs such as SQF, BRCGS, FSSC 22000 and IFS, and passing one leads to a certificate buyers can accept.

A second-party audit serves a buyer: the customer, or a firm it hires, audits the supplier against that customer's requirements. A third-party audit is done by an organization independent of both supplier and customer, usually an accredited certification body auditing to a published standard, and often ends in a certificate any buyer can check.

A food safety inspection is a government check of compliance with food law by FDA, USDA or a state or local agency, and it can lead to enforcement. A food safety audit is a voluntary or contractual assessment against a standard or a buyer's requirements, and it leads to a certificate or report. Even audits under FDA's accredited third-party program aren't FDA inspections.

Most U.S. food companies aren't legally required to have a third-party food safety audit; FDA declined to make third-party certification mandatory. FSMA makes an onsite audit, at least annually, the default when a supplier controls a hazard with a reasonable probability of causing serious illness or death, unless a written determination supports another approach (21 CFR 117.430). FSVP has a matching rule for importers.

A food safety audit company audits food sites against food safety standards. Companies that certify sites to GFSI-recognized schemes are certification bodies, each accredited by an accreditation body and licensed by the scheme owner. Others perform second-party audits for buyers or GMP audits. Consultants help you prepare but can't certify you.

To find accredited food safety audit companies, use the scheme owners' directories: SQFI's certification body directory, BRCGS's list of certification bodies, Foundation FSSC's licensed certification bodies and the IFS search. Then confirm accreditation with the accreditation body, such as ANAB in the U.S., and check that the scope covers your products. Links are in how to verify an audit company.

The food safety audit you need is the one your customers accept. Ask each buyer which scheme, edition and scope they require and whether they add their own audit on top. If they accept any GFSI-recognized scheme, compare schemes by sector fit, how results are reported, unannounced-audit rules and which licensed certification bodies cover your scope.

A food safety audit of a supplier isn't the same as a restaurant health inspection. Restaurant and retail inspections are done by state and local health departments under rules modeled on FDA's Food Code, now in its 2026 edition. A third-party audit is a voluntary or contractual check of a manufacturer, packer or other supplier against a standard or a buyer's requirements.

A food safety audit's length depends on the scheme and your site. Scheme rules set audit days from factors such as site size, employees, process complexity and HACCP plans: SQF sets a 2-day minimum for certification audits, IFS's calculation tool starts at 2 days, and BRCGS uses a mandatory duration calculator. Ask for the planned audit days in writing.

Third-party food safety audits usually happen every year. Some schemes add a 6-month audit after a low result, such as BRCGS C and D grades and SQF C ratings, and GFSI-recognized schemes must give processing sites at least one unannounced audit every three years. Where FSMA requires an onsite supplier audit, the default is at least once a year.

Passing scores differ by scheme: SQF Edition 9 certifies sites scoring 70 or above, IFS Food needs at least 75% (Foundation level; Higher level from 95%), PrimusGFS needs at least 85% to proceed to certification, and CanadaGAP sets 85%, 95% or 100% by option. BRCGS grades AA to D instead of scoring, and FSSC 22000 has no score: a site is certified or not.

If a food safety audit finds problems, you get non-conformities to fix. Minors and majors are closed with evidence within the scheme's deadline, typically 28 to 30 days. A critical finding, or majors not closed in time, can mean no certificate or a suspended one, and a new audit. Your customers' rules decide what that means for your business with them.

Not if it's the certification body: under ISO/IEC 17065, a certification body may not consult for its clients. Scheme rules add to this: GFSI requires auditor-appointment rules that consider any pre-audit or consulting by the auditor, and SQF bars an auditor from auditing a site they consulted for in the past two years. Prepare with your own team or a consultant.

A GFSI-recognized certification audit can satisfy FSMA supplier verification, but not automatically. FDA said audits under GFSI schemes that consider FDA's food safety regulations and review the supplier's written food safety plan are likely to meet the onsite audit requirement. Keep the audit report, not just the certificate: your records must show the procedures, dates, conclusions, corrective actions and that a qualified auditor did it.

Certification is what a certification body gives your site after a successful audit; accreditation is what an accreditation body, such as ANAB in the U.S., gives the certification body after assessing its competence and impartiality. For GFSI-recognized programs, the certification body must be accredited to ISO/IEC 17065, or ISO/IEC 17021-1 with ISO/TS 22003-1.

An unannounced food safety audit is one where the site isn't told the date in advance. GFSI-recognized schemes must give processing sites at least one every three years: SQF makes one recertification audit in three unannounced, BRCGS requires at least one every three years and adds a "+" to the grade, and IFS Food makes at least every third audit unannounced.

Yes, a site can change food safety audit companies, usually at recertification. The new certification body must be accredited and licensed for your scheme and scope. Each scheme has transfer rules, so ask how it will handle your current certificate, audit schedule and any open non-conformities before you sign.

Third-party audit results are partly public: most schemes publish which sites are certified, not the audit report. SQFI's certified site directory, the BRCGS Directory, FSSC 22000's public register and CanadaGAP's certified companies list are open to anyone; the IFS Database needs a login, but IFS certificates carry a QR code to check them. Reports stay with the certified company.

A third-party food safety audit's cost depends mostly on audit days, which scheme rules set from your site's size and complexity, plus travel and any scheme owner fees, such as SQFI's annual site registration of $250 to $800 for a single site. There's no industry price list, so ask each audit company to quote the same scope, with audit days, travel and fees shown separately.

The site being audited usually pays: the certification body for audit days and travel, and in some schemes the scheme owner directly, such as SQFI's annual site registration. For a second-party audit, the buyer sometimes pays instead. For FSMA supplier verification audits, FDA's rules bar payment that depends on the audit result.