The Email You Were Not Expecting
It usually arrives on a Tuesday. Your co-packer's quality manager writes: "Our SQF audit is the week of the 14th. Can you send over the current spec package for your SKUs by Friday?"
If you have been through it before, that is a two-hour task. If you have not, it is a week of panic, because the request is for documents you may not know exist, some of which have to come from your suppliers, and at least one of which can take longer to obtain than the notice you were given.
The audit is at their facility, against their systems, and the certificate has their name on it. But a real portion of the evidence an auditor asks for is about your product, and the co-packer can only produce it if you handed it over. When a founder cannot, the co-packer does not fail. The co-packer quietly decides your account is more work than it is worth.
First, What These Schemes Are
SQF and BRCGS are both food safety certification schemes benchmarked by the Global Food Safety Initiative. GFSI does not audit anyone. It benchmarks schemes so that a retailer can say "we accept any GFSI-recognized certification" instead of running its own audit program.
SQF is the Safe Quality Food program, administered by SQFI, which sits under FMI. Its Food Safety Code for manufacturing has been running through Edition 9, with a further edition published and phasing in. Confirm with your co-packer which edition they are being audited against, because module numbering shifts between editions and a checklist you pulled off the internet may be a version behind.
BRCGS publishes the Global Standard Food Safety. Issue 9 was published in August 2022 and holds GFSI recognition; a subsequent issue has been through public consultation. Same advice: ask which issue applies.
Practically, the difference matters less than founders expect. Both want a HACCP-based food safety plan, a validated process, documented prerequisite programs, supplier approval, allergen control, traceability, and evidence that the site does what its documents say. Both produce a graded outcome. BRCGS grades run AA, A, B, C and D, with a plus suffix when the audit was unannounced. SQF reports a rating along the lines of Excellent, Good, or Complies. The exact score bands and the correction windows for minor, major, and critical nonconformities are set by the scheme and the certification body, so treat the ranges quoted in blog posts as directional and confirm the current bands with the certifying body.
The part that catches brands off guard is unannounced audits. Both schemes have unannounced options, and some retailers push their suppliers toward them. If your co-packer is on an unannounced program, "I will get you that spec next month" is not a workable answer. The auditor may already be in the building.
The Document Package the Brand Owner Owes
Here is the set I build with founders before a co-packer relationship goes live, not after. Every item on this list exists to answer a question an auditor will ask.
1. A finished product specification
One document per SKU. Product name, pack size and configuration, declared net contents, target and range for the specs that matter (pH, water activity, Brix, viscosity, fill weight, color), the shelf-life claim, storage conditions, and the packaging components by supplier and part number. If your co-packer is working from an email chain instead of a spec, that is a finding waiting to happen, and it is also why your co-packer's version does not taste like yours.
2. Ingredient specifications for every input
Not the ingredient statement. The spec: supplier name and address, the supplier's product code, the functional and analytical parameters you rely on, the allergen status, the country of origin where it matters, and the storage and shelf-life conditions. Every ingredient. Including the salt.
3. Certificates of analysis, current and readable
The auditor is checking that incoming material is verified against a spec, which means someone has to compare a COA against something. If you do not know how to read one, the COA cheat sheet covers what each section means. The failure mode I see is a COA on file that nobody ever compared to a spec, which is worse than no COA, because it demonstrates a program that exists on paper only.
4. Letters of guaranty or continuing guaranty from your suppliers
A supplier statement that the ingredient is not adulterated or misbranded within the meaning of the Federal Food, Drug, and Cosmetic Act. These are routine and most established ingredient suppliers issue them on request. Small or specialty suppliers, the kind a real-ingredient brand loves, often have never been asked, and getting one out of a family chili operation in October can take weeks. Ask early.
5. An allergen matrix for your formula
Which of the major food allergens are present in your product, which are present in any ingredient including carriers and processing aids, and what your label declares. The auditor is verifying the co-packer's allergen program, but the input to that program is your formula. Shared lines make this the highest-stakes document in the package, for the reasons laid out in allergen control in co-packing.
6. Approved label artwork, and the approval trail
Current artwork, the ingredient statement in descending order of predominance, the allergen declaration, the net contents statement, the nutrition panel, and the name and address of the responsible firm. The auditor is checking that the label applied on the line is the label you approved, so the version control matters as much as the content. Include where your lot code and date code print and what format they take.
7. The process authority letter or scheduled process, if your product needs one
For acidified foods this is not optional documentation, it is the scientific basis of the process the facility is running. See the process authority primer. If you do not have it, the co-packer is running your product without a validated process, which is a much bigger problem than an audit finding.
8. Shelf-life validation data
Whatever supports the date you print. Real-time study, accelerated study, or a documented rationale, as covered in shelf life testing. "The last batch was still fine at ten months" is a data point, not a validation.
9. Food-contact compliance letters for packaging you supply
If you source your own jars, closures, liners, films, or labels, the auditor will want evidence those materials are suitable for food contact. The supplier issues these. If you buy through a broker, ask them to chase it.
10. Certification certificates for any claim on your label
Organic, kosher, gluten-free, Non-GMO Project Verified. If the claim is on the jar, the scheme requires evidence behind it, and organic in particular brings its own handling requirements at the facility. The economics of whether a given seal is worth it are covered in do you need organic, Non-GMO, or gluten-free certification.
Where Brand Owners Get Caught
Three patterns, all avoidable.
You became a supplier without noticing. If you are tolling, meaning you buy the defining ingredients and ship them in, then you are an approved supplier in the co-packer's system. You will be asked for the same approval evidence any ingredient vendor provides: specs, COAs, guaranties, sometimes a questionnaire about your own storage and handling. Founders who negotiated tolling to protect ingredient quality, which I usually support, are often surprised to find themselves inside someone else's supplier approval program.
Your documents disagree with each other. The spec says pH 3.8 maximum, the artwork says 12 months, the shelf-life study ran 9, and the COA on file is from a supplier you stopped using last year. An auditor's favorite move is to pull three documents and read them against each other. Internal contradictions are the cheapest findings in the building.
You sent the ingredient statement instead of the specification. These are not the same document and they are not close. The ingredient statement is label copy. The specification is a technical control document. If you are not sure yours qualifies, what makes a recipe production-ready is the standard to measure it against.
Is Your Own Certification Worth It?
Founders sometimes ask whether they should pursue SQF or BRCGS certification for their brand. If you do not operate a facility, generally no. These schemes certify sites, not recipes. A brand that produces entirely through a certified co-packer is buying access to that certification through the relationship, and the useful investment is in the document package above, not in a certificate you cannot really hold.
That changes the day you take production in house. At that point the certification is a site decision with a real cost structure, and it belongs in the same conversation as commissary kitchen versus co-packer.
The Honest Reason to Do This Early
An audit is a snapshot of whether a facility does what it says. Your spec package is the part of that snapshot you control. Founders who keep it current get treated as a low-maintenance account, get scheduled more readily, and get fewer surprise substitutions, because the facility knows exactly what it is allowed to do with your product.
Founders who scramble every time get something subtler and worse: a co-packer who starts filling gaps with assumptions. That is how the garlic becomes garlic powder and nobody remembers approving it.
Sources: SQFI, Safe Quality Food Institute · SQFI, Approved Supplier Program guidance · BRCGS, Global Standard Food Safety · GFSI, recognition of BRCGS Food Safety Issue 9 · FDA, Guidance for Industry: Supply-Chain Program Requirements and Co-Manufacturer Supplier Approval and Verification
Need Help With Your Formulation?
Whether you're scaling your first recipe or reformulating an existing product, let's talk about how to get it right.
Book a Free Discovery Call
