Water activity is not the be all and end all.
Remiind your employers of incidents such as the following contamination scares -
2008 - Wheat flour contaminated with naturally-occurring pyrrolidizine alkaloids is thought to be the cause of 38 cases of hepatic veno-occlusive disease including 4 deaths in Afghanistan
2011 - German E. coli O104:H4 outbreak was caused by EHEC O104:H4 contaminated fenugreek seeds imported from Egypt in 2009 and 2010.
2012, August - September - Multiple American Licorice Company black licorice products recalled due to high lead levels in the products. Consuming a bag of product could give children lead levels as high as 13.2 micrograms/daily limit, double the amount regulators consider actionable.
But that said - you are working with a very low risk product so you would not need the rigorous testing schedule like a more high risk product.
Maybe determine top 3 possible contaminants based on investigation into where it comes from / possible contaminants etc etc and test for them once evry three months (or based on risk) to show due care?