How do I audit a manufacturer, and what goes on the checklist?
Start with the audit the manufacturer already has, then check what it leaves out. Food sites are audited against schemes such as BRCGS, IFS Food or FSSC 22000; Article 8 of Regulation (EC) No 1223/2009 requires good manufacturing practice (GMP) for cosmetics; SMETA covers labour and safety. A certificate covers its holder, site and scope, not your product.
Which audit schemes cover a private label manufacturer?
Food sites are audited against BRCGS Food Safety, IFS Food or FSSC 22000; household and personal care sites against IFS HPC; cosmetics sites against good manufacturing practice, which EU law requires; and working conditions in any group against SMETA. Each scheme owner decides what its auditors check, so a certificate covers that scheme's scope only.
IFS says IFS Food "reviews the products and production processes" of a food producer; its audits are annual, and at least every third audit is unannounced. Foundation FSSC says FSSC 22000 "contains a complete Certification Scheme for Food Safety Management Systems", built on ISO 22000 and the ISO 22002 series.
| Scheme | Owner | What it covers | Named by listed manufacturers | Where to check a site |
|---|---|---|---|---|
| BRCGS Food Safety and nine other BRCGS standards | BRCGS | Food safety; also Packaging Materials, Consumer Products, Storage and Distribution, Retail, Agents and Brokers, Plant-Based, Gluten-Free, Start, and Ethical Trade and Responsible Sourcing | 32 | BRCGS Directory |
| IFS Food | IFS Management GmbH | Products and production processes: a food producer's ability to produce safe products, plus authenticity, quality, legal requirements and customer specifications. Annual audits; at least every third one unannounced | 1 | IFS Database, or the certification body named on the certificate |
| IFS HPC (version 3) | IFS Management GmbH | The safety and quality management system and production processes for household and personal care products, retailer private label included | 0 | The certification body named on the certificate |
| FSSC 22000 (version 7) | Foundation FSSC | Food safety management systems, built on ISO 22000 and the ISO 22002 series; recognised by the Global Food Safety Initiative (GFSI) | 30 | FSSC Public Register |
| Good manufacturing practice for cosmetics | Required by Article 8 of Regulation (EC) No 1223/2009 | The manufacture of cosmetic products; compliance is presumed when it follows the harmonised standards published in the Official Journal | 21 of 75 cosmetics manufacturers name ISO 22716 | The certificate document and the certification body that issued it |
| SMETA | Sedex | Labour standards and health and safety in every audit; environment and business ethics in the 4-pillar version | An audit report: ask for it | Sedex platform; uploading an audit requires membership |
A scheme counts as named when the manufacturer's own website names it, counted the way the certificates guide counts it; a scheme named without its scope, such as plain IFS, is not counted. A name on a website is a claim until you see the document.
Which audit does your product and your buyer decide for you?
Your product group and your customer decide which audit to ask for, so settle them before you compare manufacturers. The scheme a manufacturer holds only tells you which buyers it can already satisfy. Each case below links a situation to a scheme, with the price of that choice in the shortlist it leaves you.
- A food or food supplement whose buyer names a food safety scheme: BRCGS Food Safety, IFS Food or FSSC 22000, on a certificate for the site that makes your product. The price: 54 of the 191 food and supplement manufacturers listed name one of the three.
- A cosmetic sold under your brand: evidence of good manufacturing practice, which Article 8 requires. The price: 21 of 75 cosmetics manufacturers name ISO 22716, and one without the certificate may still work to GMP, which you then check yourself.
- A household or personal care product for a retailer's own brand: IFS HPC, which IFS writes for retailer private label among others. The price: no listed manufacturer names it, so expect to ask rather than filter.
- A buyer with a labour or ethical sourcing policy: a SMETA audit report and its corrective action plan. The price: the report sits on the Sedex platform, so the manufacturer has to share it with you.
- Furniture, textiles and other consumer goods: BRCGS publishes a Consumer Products standard, and the product certificates for wood and textiles are in the certificates guide. Your own audit carries more of the weight here.
Is there an audit standard for cosmetics manufacturers?
The law sets the duty and a standard shows it is met. Regulation (EC) No 1223/2009, Article 8 says "the manufacture of cosmetic products shall comply with good manufacturing practice". Compliance is presumed where manufacture follows the relevant harmonised standards published in the Official Journal. The Regulation itself does not name ISO 22716.
For a brand this matters directly. Article 4(6) of the same Regulation makes a distributor the responsible person where it places a cosmetic on the market under its own name or trade mark, and Article 11 requires the product information file to be kept for ten years after the last batch is placed on the market.
IFS HPC covers "the safety and quality management system and production processes" for household and personal care products; the IFS page does not name cosmetics. Ask a cosmetics manufacturer which GMP standard its certificate names, which certification body issued it and which site it covers.
Is a certificate enough, or should I audit the manufacturer myself?
A certificate tells you that a certification body checked the site against a scheme, on a date, within a scope. Your own audit is one you run, or pay an auditor to run, against your own checklist. The certificate is quicker to check; only your own audit looks at your product and your documents.
The price of relying on a certificate: it covers the holder, the site and the scope it names, and says nothing about your formula, your packaging or your batch. The price of your own audit: your time and travel, or an auditor's fee, and a checklist you have to write.
ISO writes that ISO 19011 "gives guidance on auditing management systems, including the principles of auditing". ISO withdrew the 2018 edition on 27 May 2026 and lists ISO 19011:2026 as its replacement, so ask an auditor which edition it works to.
What goes on the audit checklist?
Check the company, the site, the scope and your product, in that order. Each line below names what to look at and the document to ask for. Send the list before the visit, so the documents are ready, and keep the completed list with the contract; run it again when the site, a partner or the formula changes.
| Item | What to look at | Document to ask for |
|---|---|---|
| Legal entity | Name, registration number and address match the company in your quotation | The register entry (free searches below) |
| Production site | The address where your product will be made, not only the registered office | Site address in the quotation; a certificate naming that site |
| Who does each step | Which steps the company does itself and which a partner or subcontractor does | A written list of subcontracted steps |
| Certificate scope and dates | Holder, site, a scope that covers your product type, and the end date | The certificate document, not the logo |
| Last audit and its findings | The result or grade, the non-conformities raised and whether they were closed | The latest audit report and its corrective action plan |
| Raw materials and suppliers | How materials are approved, checked on arrival and traced to each batch | Supplier approval procedure; the specification of one material |
| Batch records | That each batch has a record of what went into it and who released it | One completed batch record of a similar product, with names removed |
| Release of finished goods | Who decides a batch is released, and on which tests | Release procedure; test methods and limits for your product |
| Product tests | For a cosmetic, the stability data, and the safety assessment that Article 10 of Regulation (EC) No 1223/2009 requires before sale | Stability data; who prepares the cosmetic product safety report |
| Complaints and recalls | How a complaint reaches the site and how a batch would be traced and withdrawn | Complaint and recall procedure |
| Labour, health and safety | Working hours, safety and the findings of any social audit | SMETA report and corrective action plan, if one exists |
| Confidentiality | Who sees your formula and artwork, and under which terms | An NDA, or a confidentiality clause in the contract |
The first three lines can be done from your desk; how to check a private label manufacturer explains them. The contract should then say who may subcontract and what you may audit: see what a manufacturing agreement should contain.
Where can I check the company and its certificates online?
In the national company register and in the scheme owner's register. The European e-Justice Portal says "as of June 2017 the business registers of all EU countries have been interconnected and become searchable". Each of the five countries also has its own register with a free search, listed below with the number to search by.
| Check | Where | Search by |
|---|---|---|
| Company in Sweden | Bolagsverket, Find company information | Organisation number: 10 digits, written 6 + 4 with a hyphen |
| Company in Finland | YTJ information service | Business ID (Y-tunnus): seven digits, a hyphen and a check digit |
| Company in Latvia | Register of Enterprises information portal | Registration number: 11 digits |
| Company in Lithuania | Register of Legal Entities, free search | Company code (įmonės kodas): 9 digits |
| Company in Estonia | e-Business Register | Registry code (registrikood): 8 digits |
| FSSC 22000 certificate | FSSC Public Register | Scheme, certificate status, country, scope, or the company's name |
| BRCGS certificate | BRCGS Directory | Not confirmed: the directory did not load for NordSourced |
| IFS certificate | IFS Database, named on the IFS Food page | Not confirmed: IFS gives no public address for it on that page |
Foundation FSSC says its register "lists all current FSSC Certified Organizations", and also sells a Public Register Plus with automatic updates. Estonia's e-Business Register calls itself "the official portal of the Estonian state that includes the data of all legal entities".
Questions and answers
What is the difference between my own audit and the manufacturer's certificate?
The certificate shows that a certification body audited the site against a published scheme, such as FSSC 22000 or IFS Food, within a stated scope and on a date. Your own audit follows your checklist and can look at your formula, your packaging and the batch records. Check the certificate first, then audit what its scope leaves out.
How often are IFS Food audits, and are they announced?
IFS Food audits are annual, and at least every third audit must be unannounced, according to IFS Management GmbH. A site that passes an unannounced audit earns Star Status. Assessed companies are visible to business partners in the IFS Database, although the IFS page gives no public address for it, so ask the certification body named on the certificate.
What is FSSC 22000 built on?
On ISO 22000 and the ISO 22002 series of prerequisite programmes. Foundation FSSC describes it as a complete certification scheme for food safety management systems, recognised by the Global Food Safety Initiative, with version 7 documents as the current set. Its page counted 42,978 certified organisations when NordSourced read it on 13 October 2026.
Does EU law require a cosmetics manufacturer to follow GMP?
Yes. Article 8 of Regulation (EC) No 1223/2009 says the manufacture of cosmetic products shall comply with good manufacturing practice. Compliance is presumed when manufacture follows the relevant harmonised standards whose references are published in the Official Journal. The Regulation does not name a standard itself, so ask which standard the manufacturer's certificate names.
Who carries out SMETA audits?
Approved audit companies, not Sedex. Sedex created and stewards SMETA but does not carry out the audits itself. Every SMETA audit covers labour standards and health and safety; the 4-pillar version, used in around 70% of SMETA audits, adds environment and business ethics. Uploading an audit to the Sedex platform requires membership.
Does BRCGS certify only food factories?
No. Besides Food Safety, BRCGS lists standards for Packaging Materials, Consumer Products, Storage and Distribution, Retail, Agents and Brokers, Plant-Based, Gluten-Free, Start, and Ethical Trade and Responsible Sourcing. Check which standard a certificate names: a packaging supplier's BRCGS certificate covers its packaging, not the food or cosmetic that goes into it.
Which ISO standard explains how to run an audit?
ISO 19011, which gives guidance on auditing management systems, including the principles of auditing. ISO withdrew the 2018 edition on 27 May 2026 and lists ISO 19011:2026 as the new version. It is guidance for auditors, so it tells you how to audit a manufacturer, not which scheme the manufacturer should hold.
How do I check that an FSSC 22000 certificate is real?
Search the FSSC Public Register, which lists all current FSSC certified organisations and filters by scheme, certificate status, country and scope, or by name. Compare the holder, the site address and the scope with your quotation. For BRCGS use the BRCGS Directory; for IFS ask the certification body named on the certificate.
How do I check that a Baltic or Nordic manufacturer is a registered company?
Search its registration number in the national register: Latvia's Register of Enterprises, Lithuania's Register of Legal Entities, Estonia's e-Business Register, Finland's YTJ or Sweden's Bolagsverket. Each has a free search. EU business registers have also been interconnected and searchable through the European e-Justice Portal since June 2017.
Which manufacturers in the Baltics have BRCGS, IFS Food or FSSC 22000?
23 of the 235 manufacturers NordSourced lists in Latvia, Lithuania and Estonia name at least one of the three on their own website, for example Amber Latvijas Balzams, Arimex, Baltic Dairy Board and BioCC. NordSourced counts a scheme when the website names it, so ask for the certificate and check it in the scheme owner's register before you rely on it.
Do any Nordic or Baltic private label manufacturers have a SMETA audit?
1 of the 443 manufacturers on NordSourced names Sedex or SMETA on its own website. A website mention does not show the audit's date or findings, so ask any manufacturer for its latest SMETA report and corrective action plan, or commission a social audit if your buyer requires one.
What documents should I ask for before I visit a factory?
The register entry, the address of the production site, the certificate with its scope and end date, the latest audit report with its corrective action plan, a list of steps done by partners, and the release procedure for finished batches. For a cosmetic, add stability data and the name of whoever prepares the safety report under Article 10 of Regulation (EC) No 1223/2009.
Can IFS HPC cover a retailer's own-brand product?
Yes. IFS HPC covers the safety and quality management system and production processes for household and personal care products, and IFS says it applies to retailer private label products, manufacturers' brands and non-branded products. Version 3 is current. The IFS page does not mention cosmetics by name, so confirm that the scope covers your product.
Where to go next
Sources
- IFS Food standard, IFS Management GmbH. Checked 13 Oct 2026.
- IFS HPC standard, IFS Management GmbH. Checked 13 Oct 2026.
- FSSC 22000 scheme, Foundation FSSC. Checked 13 Oct 2026.
- FSSC Public Register, Foundation FSSC. Checked 13 Oct 2026.
- BRCGS standards (home page, with the BRCGS Directory link), BRCGS. Checked 13 Oct 2026.
- Regulation (EC) No 1223/2009 on cosmetic products, Articles 4, 8, 10 and 11, European Parliament and Council (OJ L 342, 22.12.2009), hosted by the European Commission. Checked 13 Oct 2026.
- SMETA audit, Sedex. Checked 13 Oct 2026.
- ISO 19011:2018, Guidelines for auditing management systems (status page), ISO. Checked 13 Oct 2026.
- Business registers: search for a company in the EU, European e-Justice Portal, European Commission. Checked 13 Oct 2026.
- Bolagsverket, Find company information (Sweden), Company register of Sweden. Checked 2 Oct 2026.
- YTJ information service (Finland), Company register of Finland. Checked 2 Oct 2026.
- Register of Enterprises information portal (Latvia), Company register of Latvia. Checked 2 Oct 2026.
- Register of Legal Entities, free search (Lithuania), Company register of Lithuania. Checked 2 Oct 2026.
- e-Business Register (Estonia), Company register of Estonia. Checked 13 Oct 2026.
Directory figures are counted from the manufacturers listed on NordSourced, each listed because its own website says it makes products for other brands; see how we check. This page is general information, not legal advice. Found a mistake? Tell us.
What does a social audit such as SMETA cover?
Working conditions, not product safety. Sedex says SMETA was "created and stewarded by Sedex", and every SMETA audit covers labour standards and health and safety. The 4-pillar version adds environment and business ethics; Sedex says it is used in around 70% of SMETA audits.
Sedex itself does not audit: "Sedex does not carry out SMETA audits directly." Approved audit companies do, findings come with a corrective action plan, and the audit data can be shared with several buyers. Ask for the report and the corrective action plan, and check the audit date.
1 of the 443 manufacturers listed on NordSourced names Sedex or SMETA on its own website. A Sedex membership lets a site share audit data; it does not show what an audit found.