I would expect most 3rd party auditors to issue a standard detailing their requirements. This should give you some specific expectations. Regardless, the minimum requirements will typically be those of any Regulatory-related authorities.
A summary of hazards in popcorn was given in previous linked thread. A short FSMA summary for (I guess, too much text to read) unpopped and a short Australian for (I assume) popped are below –
FSMA popcorn - hazards.png 118.37KB
S.Australia - popcorn2 - hazard.png 71.08KB
I deduce yr process is basically receiving unpopped popcorn, popping it, flavouring it, packing it, labelling it, storing it.
As per my post in previous thread/ yr description, IMO there is 1 potential CCP which is the popping stage. I deduce you have no metal detector which would have been a second CCP. I anticipate you will need to validate the bacterial reduction at the popping stage.
The popping stage sounds similar to some oven baking processes inasmuch as raw/”cooked” share the same area. Since no physical separation of raw/cooked, for baking ovens BRC had to make a special case for this scenario where the (lack of) risk of cross-contamination had to be specifically approved by the auditor. No idea as to FDA’s viewpoint or other 3rd party.
I assume product is “rapidly” cooled/processed/transferred to storage after popping so no significant hazard due spores such as B.cereus. This needs to be validated.
Environmental micro. risks after popping are presumably controlled by GMP and might be 3rd party (via FDA regulations?) expected to be subject to validation/monitoring, eg L.mono, Salmonella. I’m not familiar enough with this product area/FDA-USDA to guess.
(In US in period 2010-2014, I noted one popcorn Recall due L.mono.)