11 replies to this topic

[AtomicDancer]

When customers ask to perform an onsite audit, are there limitations the company can set for when customers are allowed to schedule an audit? 

Is it common to tell auditors we cannot accommodate them during certain months of the year due to staffing/production schedules? 

 

We typically don't schedule during our SQF unannounced audit window as we cannot support 2 audits at once but would also like to remove Nov-Dec from our available time for customer audits. 

[GMO]

We used to try but it wasn't always possible. One thing our retailers used to accept though was if they turned up and a GFSI auditor was on site, they would leave at no cost to us. So we didn't block out our GFSI window.

[mcauley.musunda@yahoo.com]

Yes — with the right framing and transparency, this is both ethically acceptable and industry-standard practice. The key is that limitations must be based on legitimate operational reasons, communicated openly, and must not obstruct the customer's fundamental right to verify your compliance.

 

The core audit ethics principles relevant here are:

1. Objectivity & Independence — The auditor's right to assess must not be compromised. Scheduling constraints are acceptable; however, they must not be used as a tactic to obscure non-compliance or make audits impractical.
2. Transparency — During planning, ethical awareness helps identify potential conflicts and scope limitations. Being upfront with customers about why certain windows are unavailable — rather than simply saying "no" — upholds this principle. 
3. Integrity — Restrictions must reflect genuine operational realities, not an attempt to manage or game audit outcomes. The distinction matters ethically and reputationally.

Is It Common Practice to Restrict Audit Windows?

Yes, this is widely accepted and practiced. Service providers and suppliers may agree to limitations regarding the frequency and timing of audits, provided the limitations do not apply to audits required by regulators or in emergency situations. Parties may agree on a forecast audit schedule for the forthcoming year to manage audit load across customers. 

 

From a third-party risk management perspective, audits must typically be scheduled well in advance to find a date that works for both parties. This mutual scheduling is the norm, not the exception.

[TimG]

You can do whatever the heck you want, just know actions have consequences. If the consequences are going to be 'lose this customer', you might want to rethink.

 

I have successfully told customers who purchased maybe 10 truckloads of product annually that we were not allowing them to audit. Had kickback from a few, but they never stopped purchasing their 10 truckloads of product. And if they had, I wasn't bluffing on losing them.

 

For the customers buying truckloads a day, they all worked with me on scheduling an audit date. 

[G M]

Like Tim said, you can tell a customer whatever you want, but the repercussion might be that they don't want to be your customer anymore.

 

Most I have dealt with are pretty reasonable about avoiding overlap with another audit or some operationally critical activity or timeframe.

[GMO]

In one company we did start to cost out the technical requirements of customers. The discounters in the UK are easy to supply from a technical perspective and generally low-ish cost. Albeit they still sometimes do their independent audits. What they don't do is weekly meetings, technical catch ups on site every couple of months or so. That I found far more disruptive than the odd audit. 

 

In the UK we have a pretty fragmented grocery sector and less loyalty / close relationships between manufacturers and retailers than there used to be. It's common now to be supplying 3-5 retailers from one site. And you can bet that ALL of them want their own audit scheme and most are unannounced.

 

Fact is, you have to get used to dealing with it. You can push back if the business isn't worth much but I think I've said on here before that my record was 3 auditors in one day. At a push we could accommodate 4 if everyone was in and this wasn't a big company. Can you really not accommodate more than one? If not, why not? Are you really going to insist that nobody takes any holiday in your audit windows? I'd build out the capacity to support audits and be more bold. For a start, it's flipping awful not knowing if your day is going to be derailed for months on end. The more days you block out, the longer your audit windows extend.

[TbuitK]

 

Yes — with the right framing and transparency, this is both ethically acceptable and industry-standard practice. The key is that limitations must be based on legitimate operational reasons, communicated openly, and must not obstruct the customer's fundamental right to verify your compliance.

 

The core audit ethics principles relevant here are:

1. Objectivity & Independence — The auditor's right to assess must not be compromised. Scheduling constraints are acceptable; however, they must not be used as a tactic to obscure non-compliance or make audits impractical.
2. Transparency — During planning, ethical awareness helps identify potential conflicts and scope limitations. Being upfront with customers about why certain windows are unavailable — rather than simply saying "no" — upholds this principle. 
3. Integrity — Restrictions must reflect genuine operational realities, not an attempt to manage or game audit outcomes. The distinction matters ethically and reputationally.

Is It Common Practice to Restrict Audit Windows?

Yes, this is widely accepted and practiced. Service providers and suppliers may agree to limitations regarding the frequency and timing of audits, provided the limitations do not apply to audits required by regulators or in emergency situations. Parties may agree on a forecast audit schedule for the forthcoming year to manage audit load across customers. 

 

From a third-party risk management perspective, audits must typically be scheduled well in advance to find a date that works for both parties. This mutual scheduling is the norm, not the exception.

 

Thanks ChatGPT

[AtomicDancer]

In one company we did start to cost out the technical requirements of customers. The discounters in the UK are easy to supply from a technical perspective and generally low-ish cost. Albeit they still sometimes do their independent audits. What they don't do is weekly meetings, technical catch ups on site every couple of months or so. That I found far more disruptive than the odd audit. 

 

In the UK we have a pretty fragmented grocery sector and less loyalty / close relationships between manufacturers and retailers than there used to be. It's common now to be supplying 3-5 retailers from one site. And you can bet that ALL of them want their own audit scheme and most are unannounced.

 

Fact is, you have to get used to dealing with it. You can push back if the business isn't worth much but I think I've said on here before that my record was 3 auditors in one day. At a push we could accommodate 4 if everyone was in and this wasn't a big company. Can you really not accommodate more than one? If not, why not? Are you really going to insist that nobody takes any holiday in your audit windows? I'd build out the capacity to support audits and be more bold. For a start, it's flipping awful not knowing if your day is going to be derailed for months on end. The more days you block out, the longer your audit windows extend.

We only have 3 people in Quality, and Quality is the point of contact for the audits (yes, we pull from other departments to answer questions when we need to).

1-2 QA people are always with the auditor, that only leaves 1 (sometimes 2) to do all quality tasks related to production. 

And yes, we allow people to take PTO during the unannounced audit window.

We only have 2 conference rooms. 

 

so yes, we can only accommodate 1 audit at a time. 

[GMO]

We only have 3 people in Quality, and Quality is the point of contact for the audits (yes, we pull from other departments to answer questions when we need to).

1-2 QA people are always with the auditor, that only leaves 1 (sometimes 2) to do all quality tasks related to production. 

And yes, we allow people to take PTO during the unannounced audit window.

We only have 2 conference rooms. 

 

so yes, we can only accommodate 1 audit at a time. 

 

 

Fair enough. But a question. Is this upside down? If you are taking on retailers demanding their own audits, AND doing direct quality tasks related to production (so I assume QC as well as QA?) AND doing GFSI... do you have enough people? It's an opportunity for you to make that ask. 

Edited by GMO, 21 July 2026 - 03:00 PM.

[TimG]

Fair enough. But a question. Is this upside down? If you are taking on retailers demanding their own audits, AND doing direct quality tasks related to production (so I assume QC as well as QA?) AND doing GFSI... do you have enough people? It's an opportunity for you to make that ask. 

 

Wait wait wait WAIT!!

You guys get enough people to do required tasks in the EU?

 

...I need to emigrate.

[MlissaB]

What is your product (food or packaging) and your risk to the customer?

 

We provide packaging for non-contact applications and are generally considered low risk. Whenever asked about customer audits we state we will allow them at mutually agreed upon times. With this we would deal with an unannounced audit window if it happens to coincide with their desired time. Most of our sites are BRC certified but customers still want to come in and do their own thing (so much for GFSI eliminating this!!!). We also state we will allow it AT THE CUSTOMER'S EXPENSE. We're done paying for customers who send in a 3rd party auditor when we are already paying for GFSI.

[GMO]

Wait wait wait WAIT!!

You guys get enough people to do required tasks in the EU?

 

...I need to emigrate.

 

I'm (sadly) not in the EU. But we have to comply with EU law in food (pretty much). No we don't always have the resource we ask for but it's always worth a try. It's a trite thing to say but one sure way not to have it is not to ask. One thing we did do is start to put a technical cost to supply and to build that into contracts. Once you start to do that, the value of those contracts changes but also there's budget available (or there should be.)