A second-party audit is the one your customer runs on you. Unlike a third-party certification audit, it is not scored against a published standard — it is scored against that buyer’s own risk register. Expect one to two days on site, roughly 70 per cent of it spent in records rather than on the plant floor, and expect the auditor to trace one finished lot backwards from the Certificate of Analysis to the incoming raw material.
What is a second-party audit, and how is it different from certification?
Three kinds of audit get confused in procurement conversations, and the difference decides what you prepare.
| Audit type | Who runs it | Scored against |
|---|---|---|
| First-party | The manufacturer, internally | Its own procedures and internal audit schedule |
| Second-party | The buyer, or an agent acting for the buyer | The buyer’s own supplier-approval criteria — which are private and vary by customer |
| Third-party | An accredited certification body | A published scheme — FSSC 22000, GMP, HACCP, halal scheme requirements |
The practical consequence: a supplier can hold every certificate on the wall and still fail a second-party audit, because the buyer is testing whether the system produces their specification repeatedly, not whether it satisfies a scheme in general. Certificates get you onto the shortlist. The second-party audit is what converts the shortlist into a purchase order.
What triggers a second-party audit?
They rarely arrive without a reason. The common triggers, in rough order of frequency:
- New supplier approval — the buyer is about to place first commercial volume and needs the file closed.
- A complaint or deviation — an out-of-specification result, a foreign body, a delivery that did not match the approved sample.
- A change at the supplier — new site, new process step, new contract packer, change of ownership.
- The buyer’s own audit — their retailer or certification body has asked them to evidence supplier oversight, so the requirement cascades down.
- Scheduled re-approval — many buyers re-audit critical raw material suppliers every two to three years.
The seven areas an auditor actually opens
Audit agendas differ in wording but converge on the same seven areas. If preparation time is short, prepare these.
1. Traceability, tested by a mock recall
This is the single most common live exercise. The auditor picks one lot number from a Certificate of Analysis and asks the plant to trace it in both directions: back to the incoming botanical raw material, its supplier and its goods-in records; and forward to every customer that received material from that lot. A credible target is one hour, with better than 99 per cent mass balance reconciled. Rehearse it. A traceability exercise that takes half a day is a finding on its own, regardless of whether the records eventually add up.
2. Specification and change control
The auditor compares the agreed customer specification with the internal manufacturing specification and the last three Certificates of Analysis. What they are hunting for is drift — an internal limit that has been quietly widened, or a specification revision that never reached the customer. Every specification should carry a version number and an issue date, and changes that affect the customer must show evidence of customer notification.
3. Raw material approval
Where did the botanical come from, and how do you know it is what the label says? Expect questions on supplier approval records, incoming inspection, species verification and how you handle a raw material that arrives out of specification. This is also where pesticide residue and MRL testing and heavy-metal screening get examined in detail.
4. Process control and the critical control points
A walk of the line, following the process flow diagram. The auditor checks that the HACCP plan on paper matches the plant in front of them: that the critical control points identified are the ones actually monitored, that monitoring records are completed at the stated frequency, and that corrective actions were taken and closed when a limit was breached. Drying, milling and any thermal step attract particular attention.
5. The laboratory
Whether testing is in-house, outsourced or both, the auditor wants to see method references, equipment calibration records, reference standards in date, and analyst competence records. Where testing is outsourced, they will ask for the contract laboratory’s accreditation scope — and check that the specific method used sits inside that scope, which is a step buyers frequently find has been skipped.
6. Hygiene, pest control and the fabric of the building
The fastest part to judge and the hardest to fake. Cleaning schedules with verification records, pest control station maps with trend analysis rather than just service dockets, glass and brittle plastic registers, and allergen segregation. For a botanical extract plant, cross-contamination between species handled in the same milling area is a recurring line of questioning.
7. People and training
Training records tied to specific job functions, not a generic attendance sheet. Auditors regularly ask a line operator to explain what they would do if a monitored parameter went out of limit, then check that the answer matches the written procedure and that the operator’s training record shows the relevant module.
Documents to have in the room before the auditor arrives
| Document | What the auditor is checking |
|---|---|
| Current certificates, with scope pages | That the certified scope covers the product being bought — not just the site |
| Product specification, versioned | Alignment with the customer’s agreed specification |
| Last three Certificates of Analysis | Consistency of results and whether every specified parameter is reported |
| HACCP plan and process flow diagram | That it reflects the current process, and was reviewed within the last year |
| Internal audit reports and closure evidence | Whether findings are genuinely closed or endlessly extended |
| Complaint log and root-cause records | Quality of root-cause analysis, not the number of complaints |
| Supplier approval file for the botanical | How upstream risk is controlled |
| Calibration schedule and certificates | Equipment in date, traceable to a national standard |
The five findings that recur
Across supplier audits in the botanical ingredient trade, the same non-conformances come up again and again. None of them require capital spending to fix.
- Specification drift. The internal specification and the customer specification disagree on at least one limit, usually because one was revised and the other was not.
- Outsourced test outside the laboratory’s accredited scope. The certificate is real; the method used is not on it.
- Traceability that works but is slow. The records exist across four systems and nobody has ever run the exercise end to end under time pressure.
- Corrective actions closed without verification. An action was taken and signed off, but no evidence was gathered afterwards to show it worked.
- Training records that are attendance registers. They prove someone sat in a room, not that they are competent to run the step.
Preparing in the four weeks before
A realistic preparation sequence for a plant that already holds its certifications:
- Week one. Ask the buyer for the audit agenda and standard. Most will send it. Reconcile the customer specification against the internal one and close any gap in writing.
- Week two. Run a full mock recall against a real lot, timed. Record where it slowed down and fix that, not the paperwork around it.
- Week three. Review open internal audit findings and complaint records. Close what can be closed with verification evidence; for the rest, prepare an honest status with a dated plan.
- Week four. Walk the plant as if you were the auditor, following the process flow. Check calibration dates, glass registers, pest station records and cleaning verification. Brief line operators on the questions they are likely to be asked.
One point worth stating plainly: auditors do not expect a perfect system. They expect a system that finds its own problems. A supplier with an open finding, a dated plan and evidence of past closures reads better than a supplier with an empty log.
Related guides
Frequently asked questions
How long does a second-party audit of an extract plant take?
Typically one to two days on site for a single-site botanical extract manufacturer. A first approval audit covering a broad product range runs to two days; a focused re-audit or a follow-up on specific findings is often a single day. Remote or hybrid document reviews ahead of the visit are increasingly common and shorten time on site.
Can a supplier fail a second-party audit while holding FSSC 22000 and GMP?
Yes. Certification confirms a management system meets a published scheme. A second-party audit tests whether that system reliably delivers one particular buyer’s specification. The most common cause of failure is not a system gap but a specification mismatch between what the buyer agreed and what the plant manufactures to.
What is the difference between an audit finding and a non-conformance?
A finding is any observation the auditor records. A non-conformance is a finding where a requirement was not met, and it is normally graded — critical, major or minor. Critical findings usually suspend approval immediately. Minor findings are closed with a corrective action plan and evidence, often within thirty days.
Should a supplier let the auditor take photographs?
That is a commercial decision and it should be agreed before the visit, not negotiated at the door. Many manufacturers permit photography of general areas but not of proprietary process equipment or formulation areas. State the policy in advance, in writing, and the restriction will not be read as evasion.
Who should represent the plant during the audit?
A quality lead who can open any record, plus the production lead for the walk. Keep the group small. Auditors read a crowded room as a sign that no single person owns the system, and answers from too many voices tend to contradict each other.
Auditing a botanical extract supplier, or preparing to be audited?
Bionutricia Extract manufactures standardised botanical extracts in Sungai Buloh, Selangor under FSSC 22000, GMP, HACCP, MeSTI, JAKIM halal certification and US FDA registration.
Reviewed by Dr Yong Yi Yi, Operation Manager, PhD Food Science & Technology. This guide is general information on supplier auditing practice for B2B ingredient buyers and manufacturers. It is not regulatory advice.
